Which versions of Fedify are affected by EUVD-2026-54151?

Fedify versions 1.2.0-2.3 contain an unauthenticated server-side request forgery enabling attackers to access internal network services and cloud metadata endpoints (including AWS IMDS) without…. A patch is available.

How to fix or mitigate EUVD-2026-54151?

Within 24 hours: inventory Fedify installations running versions 1.2.0-2.3 and document their network scope. Within 7 days: implement network segmentation to block outbound access from affected Fedify servers to internal RFC 1918 subnets and cloud metadata endpoints (169.254.169.254); apply WAF or firewall rules to restrict /.well-known/nodeinfo endpoint access. Within 30 days: monitor Fedify release channels for patched versions, review audit logs for SSRF exploitation indicators, evaluate alternative software, and rotate any cloud credentials accessible from affected servers.

Fedify EUVD-2026-54151

Q: What is the CVSS score of EUVD-2026-54151?

EUVD-2026-54151 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-62857 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-06 security-advisories@github.com

SSRF

8.8

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network-reachable SSRF with no auth or interaction required; scope changed because internal services outside Fedify's authorization boundary are accessed and their data exfiltrated.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 06, 2026 - 23:03 EUVD

Analysis Generated

Aug 06, 2026 - 22:51 vuln.today

CVE Published

Aug 06, 2026 - 22:18 cve.org

HIGH 8.8

DescriptionCVE.org

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

AnalysisAI

Server-side request forgery in Fedify's getNodeInfo() function allows unauthenticated remote attackers to pivot through a Fedify server into internal network services - including loopback interfaces, cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), and RFC 1918 private networks - by returning a crafted /.well-known/nodeinfo document with a malicious links[].href value. Affected versions span the 1.9 through 2.3 maintenance lines starting from 1.2.0, with response bodies from internal services returned directly to the initiating attacker. No confirmed active exploitation (not in CISA KEV) and no POC status was provided in the input data, but SSRF against cloud metadata is a high-value, well-understood attack path.

Technical ContextAI

Fedify is a TypeScript library implementing the ActivityPub federation protocol, enabling developers to build fediverse-compatible server applications. The NodeInfo protocol (nodeinfo-schema.org) is used in federated social networking to exchange server capability metadata: a server first fetches /.well-known/nodeinfo to discover a links array containing href URLs pointing to the actual NodeInfo document. Fedify's getNodeInfo() consumes this discovery response and follows the href values directly. The root cause is CWE-918 (Server-Side Request Forgery): user-controlled input from the remote server's links[].href field is used to construct and execute a server-side HTTP request without validating the URL scheme (e.g., blocking file://, gopher://, dict://), checking for open redirects, or filtering private/reserved IP ranges per IANA (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L confirms network-reachable exploitation with no authentication or attack prerequisites required against the victim Fedify instance.

RemediationAI

Upgrade Fedify to the patched release for the applicable maintenance line: 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, or 2.3.2. Release artifacts are published at https://github.com/fedify-dev/fedify/releases/tag/2.3.2 and patch details are documented in the security advisory at https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5. Where immediate patching is not feasible, implement network-level egress filtering on the application server to block outbound HTTP requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) - this prevents the most critical SSRF pivot paths including cloud metadata endpoints, though it does not fix the vulnerability and may require firewall or iptables rules at the host or VPC level. Cloud deployments on AWS should additionally consider IMDSv2 enforcement (requiring token-based metadata access), which limits SSRF exploitation of the metadata endpoint even if egress filtering is incomplete. Disabling the NodeInfo federation feature entirely eliminates the attack surface but breaks inter-server compatibility in federated deployments.