CVE-2026-34148
EUVD-2026-1929506.04.2026, 16:16
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| fedify | fedify\/fedify | 𝑥 < 1.9.6 |
| fedify | fedify\/fedify | 1.10.0 ≤ 𝑥 < 1.10.5 |
| fedify | fedify\/fedify | 2.0.0 ≤ 𝑥 < 2.0.8 |
| fedify | fedify\/fedify | 2.1.0 ≤ 𝑥 < 2.1.1 |
| fedify | fedify\/vocab-runtime | 𝑥 < 2.0.8 |
| fedify | fedify\/vocab-runtime | 2.1.0 ≤ 𝑥 < 2.1.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| fedify | fedify | 𝑥 < 1.9.6 | CNA |
| fedify | fedify | 𝑥 < 2.0.8 | CNA |
References