Log in Start free

Vulnerability · Published Dec 22, 2025 · Assigned by GitHub_M

CVE-2025-68475Fedify has ReDoS Vulnerability in HTML Parsing Regex

High 7.5

In plain English

A high-severity regular-expression denial of service in fedify from fedify-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@fedify/fedify1.6.13GHSA-rchf-xwx2-hm93
npm@fedify/fedify1.7.14GHSA-rchf-xwx2-hm93
npm@fedify/fedify1.8.15GHSA-rchf-xwx2-hm93
npm@fedify/fedify1.9.2GHSA-rchf-xwx2-hm93

Affected products (as reported)

VendorProductVersions
fedify-dev fedify < 1.6.13>= 1.7.0, < 1.7.14>= 1.8.0, < 1.8.15>= 1.9.0, < 1.9.2

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References