What is the CVSS score of CVE-2026-50131?

CVE-2026-50131 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Fedify are affected by CVE-2026-50131?

Fedify ActivityPub library (versions 0.11.2-2.2.3) contains a vulnerability allowing attackers to redirect internal server requests to access private corporate networks and infrastructure; while no…. A patch is available.

How to fix or mitigate CVE-2026-50131?

Within 24 hours: Inventory all systems running Fedify versions 0.11.2-2.2.3 and audit their network access; implement firewall rules blocking outbound connections from affected services to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 224.0.0.0/4, and reserved multicast/benchmarking ranges). Within 7 days: Monitor official Fedify project and GitHub advisory GHSA-xw9q-2mv6-9fr8 for patch availability; evaluate network segmentation to isolate affected services. Within 30 days: Execute upgrade plan immediately upon vendor patch release; if patch timeline remains uncertain, evaluate alternative ActivityPub implementations.

Fedify CVE-2026-50131

EUVD-2026-36132 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-10 GitHub_M

GHSA-xw9q-2mv6-9fr8

SSRF Fedify Vocab Runtime

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Federation fetches happen automatically over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); SSRF to internal services typically reads sensitive data (C:H) with limited write/availability impact (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 10, 2026 - 22:01 EUVD

Analysis Generated

Jun 10, 2026 - 21:18 vuln.today

CVE Published

Jun 10, 2026 - 20:27 cve.org

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on @fedify/vocab-runtime (5 direct, 2 indirect)

Ecosystem-wide dependent count for version 2.1.0.

DescriptionCVE.org

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The validatePublicUrl() protection relies on isValidPublicIPv4Address() to reject non-public IPv4 destinations. The function blocks common private and local ranges such as 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.

Articles & Coverage 1

chaitanyagarware.medium.com How I Found CVE-2026–50131: An Incomplete SSRF Fix in Fedify Jun 19, 2026

AnalysisAI

Server-Side Request Forgery in the Fedify ActivityPub library (versions 0.11.2 through 2.2.3, with branch-specific cutoffs) allows remote attackers to coerce outbound fetches to non-public IPv4 destinations because the isValidPublicIPv4Address() allow-list misses several reserved, multicast, benchmarking, and CGNAT ranges. This is an incomplete-fix bypass of the SSRF mitigation originally tracked as GHSA-p9cg-vqcc-grcx, and at time of analysis there is no public exploit identified, though the underlying logic and patch diff are publicly disclosed in the GHSA-xw9q-2mv6-9fr8 advisory. Federated servers built on Fedify are exposed whenever they fetch attacker-controlled ActivityPub documents or media.

Technical ContextAI

Fedify is a TypeScript framework that implements ActivityPub for federated (fediverse) applications and ships an accompanying vocab-runtime package; both CPEs fedify-dev:fedify and fedify-dev:vocab-runtime are listed as affected. ActivityPub by design requires servers to dereference remote URLs (actor profiles, objects, attachments, media) supplied by other instances, which makes SSRF (CWE-918) a structural risk class. The library guards these fetches with validatePublicUrl(), which delegates IPv4 destination filtering to isValidPublicIPv4Address(). The original fix correctly excluded RFC1918 (10/8, 172.16/12, 192.168/16), loopback (127/8), and link-local (169.254/16) ranges, but did not exclude other non-routable or special-use blocks such as 100.64.0.0/10 (CGNAT), 192.0.0.0/24, 192.0.2.0/24 / 198.51.100.0/24 / 203.0.113.0/24 (TEST-NET), 198.18.0.0/15 (benchmarking), 224.0.0.0/4 (multicast), and 240.0.0.0/4 (reserved). Any of these can resolve to internal hosts in real deployments (especially CGNAT on cloud and ISP networks), which re-introduces the SSRF the prior mitigation was supposed to close.

RemediationAI

Vendor-released patch: upgrade to Fedify 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4 on the matching release branch as documented in https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8, and update vocab-runtime in lockstep. If immediate upgrade is not possible, deploy Fedify behind an egress proxy or firewall that explicitly denies traffic to 100.64.0.0/10, 192.0.0.0/24, 192.0.2.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4, and the cloud metadata address 169.254.169.254 (note: blocking 169.254/16 may already be enforced but verify), accepting that this can break legitimate fetches to hosts that happen to sit behind CGNAT. Avoid running the Fedify process on instances with IMDSv1 enabled - require IMDSv2 token-bound metadata on AWS or equivalent hardened metadata on other clouds - to neutralise the highest-impact SSRF target while patching.