CVE-2026-34148
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-400, CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedify:fedify\/fedify
- fedify:fedify\/vocab-runtime
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/fedify | <1.9.6 | 1.9.6 |
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/vocab-runtime | <2.0.8 | 2.0.8 |
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/vocab-runtime | >=2.1.0 <2.1.1 | 2.1.1 |
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/fedify | >=1.10.0 <1.10.5 | 1.10.5 |
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/fedify | >=2.0.0 <2.0.8 | 2.0.8 |
| GHSA-gm9m-gwc4-hwgp | npm | @fedify/fedify | >=2.1.0 <2.1.1 | 2.1.1 |