What is the CVSS score of CVE-2026-34148?

CVE-2026-34148 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Fedify are affected by CVE-2026-34148?

Fedify's ActivityPub document loader contains an unbounded HTTP redirect vulnerability that allows unauthenticated remote attackers to exhaust server resources through denial of service.. A patch is available.

How to fix or mitigate CVE-2026-34148?

Within 24 hours: Identify all systems running Fedify and document current versions in use. Within 7 days: Upgrade to patched versions (1.9.6, 1.10.5, 2.0.8, or 2.1.1 depending on your current major version branch). Within 30 days: Conduct post-upgrade testing of ActivityPub federation functionality and validate no service disruptions occurred during migration.

Fedify CVE-2026-34148

EUVD-2026-19295 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-06 GitHub_M

GHSA-gm9m-gwc4-hwgp

Denial Of Service Fedify Vocab Runtime

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 25, 2026 - 18:07 vuln.today

cvss_changed

Patch released

Apr 07, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 06, 2026 - 15:30 euvd

EUVD-2026-19295

Analysis Generated

Apr 06, 2026 - 15:30 vuln.today

CVE Published

Apr 06, 2026 - 15:06 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @fedify/fedify (2 direct, 0 indirect)
7 npm packages depend on @fedify/vocab-runtime (5 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.10.0 and other introduced versions.

DescriptionGitHub Advisory

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

AnalysisAI

Unbounded HTTP redirect following in Fedify's ActivityPub document loaders enables resource exhaustion attacks. Remote unauthenticated attackers can trigger denial of service by controlling ActivityPub key or actor URLs that redirect indefinitely, forcing affected servers (Fedify versions before 1.9.6, 1.10.5, 2.0.8, and 2.1.1) to make repeated outbound requests from a single inbound request. No public exploit identified at time of analysis, though the attack vector is straightforward given the low complexity (CVSS AC:L). CVSS base score 7.5 (High) reflects network-reachable, unauthenticated access with high availability impact.

Technical ContextAI

Fedify is a TypeScript library implementing ActivityPub, the W3C federation protocol used in decentralized social networks like Mastodon. The vulnerability (CWE-400: Uncontrolled Resource Consumption) exists in Fedify's remote document loader and authenticated document loader components, which fetch ActivityPub objects and actor profiles over HTTP. These loaders follow HTTP 3xx redirects recursively without implementing standard protections: no maximum redirect hop count (typically 5-20 in production HTTP clients) and no visited-URL tracking to detect redirect loops. When processing federated ActivityPub messages, servers using vulnerable Fedify versions (all releases before the 1.9.6, 1.10.5, 2.0.8, and 2.1.1 patches across multiple version branches) will chase infinite redirect chains. The CPE identifiers indicate both the core @fedify/fedify package and the @fedify/vocab-runtime vocabulary handling component are affected, suggesting the flaw exists in shared HTTP client logic used throughout the library's federation stack.

RemediationAI

Upgrade Fedify to a patched version immediately based on your current major version branch. For version 1.9.x and earlier, upgrade to 1.9.6 or later. For version 1.10.x, upgrade to 1.10.5 or later. For version 2.0.x, upgrade to 2.0.8 or later. For version 2.1.0, upgrade to 2.1.1 or later. The patches implement redirect count limits and loop detection in the remote document loader and authenticated document loader to prevent unbounded recursion. Update the @fedify/fedify package via your npm or package manager, then restart federation services. No workarounds are available; the flaw requires code-level fixes in the library's HTTP client logic. Verify the upgrade by checking package.json or package-lock.json for the corrected version number. Consult the GitHub security advisory at https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp for additional technical details and version-specific guidance.