Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34148Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

High 7.5

In plain English

A high-severity uncontrolled resource consumption in fedify from @fedify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@fedify/fedify1.9.6GHSA-gm9m-gwc4-hwgp
npm@fedify/fedify1.10.5GHSA-gm9m-gwc4-hwgp
npm@fedify/fedify2.0.8GHSA-gm9m-gwc4-hwgp
npm@fedify/fedify2.1.1GHSA-gm9m-gwc4-hwgp
npm@fedify/vocab-runtime2.0.8GHSA-gm9m-gwc4-hwgp
npm@fedify/vocab-runtime2.1.1GHSA-gm9m-gwc4-hwgp

Affected products (as reported)

VendorProductVersions
@fedify fedify < 1.9.6>= 1.10.0, < 1.10.5>= 2.0.0, < 2.0.8>= 2.1.0, < 2.1.1
@fedify vocab-runtime < 2.0.8>= 2.1.0, < 2.1.1

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References