Fedify vulnerable to allowing access to internal network resources
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dahlia | fedify | before 0.9.2; = 0.10.0; = 0.11.0 | 0.9.2 | Patch available | CNA |
| — | @fedify/fedify (npm) | before 0.9.2 | 0.9.2 | Patch available | GHSA-p9cg-vqcc-grcx |
| — | @fedify/fedify (npm) | 0.10.0 to before 0.10.2 | 0.10.2 | Patch available | GHSA-p9cg-vqcc-grcx |
| — | @fedify/fedify (npm) | 0.11.0 to before 0.11.2 | 0.11.2 | Patch available | GHSA-p9cg-vqcc-grcx |
- fedify Vendordahlia Affected before 0.9.2; = 0.10.0; = 0.11.0 Fixed in 0.9.2 Patch available CNA
- @fedify/fedify (npm) Vendor— Affected before 0.9.2 Fixed in 0.9.2 Patch available GHSA-p9cg-vqcc-grcx
- @fedify/fedify (npm) Vendor— Affected 0.10.0 to before 0.10.2 Fixed in 0.10.2 Patch available GHSA-p9cg-vqcc-grcx
- @fedify/fedify (npm) Vendor— Affected 0.11.0 to before 0.11.2 Fixed in 0.11.2 Patch available GHSA-p9cg-vqcc-grcx
Remediation
- Fix · CNA fedify (dahlia) Fixed in 0.9.2
- Fix · GHSA-p9cg-vqcc-grcx @fedify/fedify (npm) Fixed in 0.9.2 Advisory →
- Fix · GHSA-p9cg-vqcc-grcx @fedify/fedify (npm) Fixed in 0.10.2 Advisory →
- Fix · GHSA-p9cg-vqcc-grcx @fedify/fedify (npm) Fixed in 0.11.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39687
- 2026-10-03 Alias added: GHSA-p9cg-vqcc-grcx
References
Other 5
- https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx
- https://github.com/dahlia/fedify/commit/30f9cf4a175704a04c874f3ea88414c5f1e00b28
- https://github.com/dahlia/fedify/commit/c641e976089dd913f649889c1bfb016df04e86ba
- https://github.com/dahlia/fedify
- https://github.com/dahlia/fedify/releases/tag/0.11.1
More dahlia vulnerabilities
- TI-2025-17006 Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism CVSS 3.1MEDIUM 5.4
- TI-2026-39357 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys CVSS 3.1HIGH 8.6
Sources
- CVE-2024-39687 · CVE Program
- CVE-2024-39687 · NVD
- FIRST EPSS
- GHSA-p9cg-vqcc-grcx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences