@fedify/fedify
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @fedify/fedifypage 1 of 1
- CVE-2024-39687HIGHCVSS 7.2EG 7.2✓ Fixed in 0.11.22024-07-05
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the …
- CVE-2025-23221MEDIUMCVSS 5.4EG 5.4✓ Fixed in 1.3.42025-01-20
vulnerable: 1.3.3
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Hos…
- CVE-2025-54888HIGHCVSS 8.7EG 8.7✓ Fixed in 1.8.52025-08-09
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and …
- CVE-2025-68475HIGHCVSS 7.5EG 7.5✓ Fixed in 1.9.22025-12-22
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader.…
- CVE-2026-34148HIGHCVSS 7.5EG 7.5✓ Fixed in 2.1.12026-04-06
vulnerable: 2.1.0
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document …
- CVE-2026-42462HIGHCVSS 7.0EG 7.0✓ Fixed in 1.9.112026-05-26
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that wou…
- CVE-2026-50131HIGHCVSS 8.6EG 8.6✓ Fixed in 1.9.122026-06-10
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fet…
Check whether @fedify/fedify is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @fedify/fedify CVEs against the assets you own.
Start Free Scan →