EUVD-2026-19295
GHSA-gm9m-gwc4-hwgp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5Blast Radius
ecosystem impact- 2 npm packages depend on @fedify/fedify (2 direct, 0 indirect)
- 7 npm packages depend on @fedify/vocab-runtime (5 direct, 2 indirect)
Ecosystem-wide dependent count for version 1.10.0 and other introduced versions.
DescriptionGitHub Advisory
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.
AnalysisAI
Unbounded HTTP redirect following in Fedify's ActivityPub document loaders enables resource exhaustion attacks. Remote unauthenticated attackers can trigger denial of service by controlling ActivityPub key or actor URLs that redirect indefinitely, forcing affected servers (Fedify versions before 1.9.6, 1.10.5, 2.0.8, and 2.1.1) to make repeated outbound requests from a single inbound request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker controls a remote ActivityPub key or actor URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate to high for internet-facing ActivityPub servers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a malicious ActivityPub server and creates an actor profile with a crafted publicKey or actor URL pointing to an endpoint under their control. This endpoint returns HTTP 302 redirects in an infinite loop (e.g., A redirects to B, B redirects to A) or a very long chain (hundreds of redirects). … |
| Remediation | Upgrade Fedify to a patched version immediately based on your current major version branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Fedify and document current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today