Read the docs
TI-2026-36902 Aliases CVE-2026-50131GHSA-xw9q-2mv6-9fr8

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Priority HIGH 76CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed fedify (fedify-dev): 1.9.12, 1.10.11, 2.0.19 +2vocab-runtime (fedify-dev): 2.0.19, 2.1.15, 2.2.4+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fedify-devfedify0.11.2 to before 1.9.12; 1.10.0 to before 1.10.11; 2.0.0 to before 2.0.19; 2.1.0 to before 2.1.15; 2.2.0 to before 2.2.41.9.12, 1.10.11, 2.0.19, 2.1.15, 2.2.4Patch availableCNA
fedify-devvocab-runtimebefore 2.0.19; 2.1.0 to before 2.1.15; 2.2.0 to before 2.2.42.0.19, 2.1.15, 2.2.4Patch availableCNA
—@fedify/fedify (npm)0.11.2 to before 1.9.121.9.12Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/fedify (npm)1.10.0 to before 1.10.111.10.11Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/fedify (npm)2.0.0 to before 2.0.192.0.19Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/fedify (npm)2.1.0 to before 2.1.152.1.15Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/fedify (npm)2.2.0 to before 2.2.42.2.4Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/vocab-runtime (npm)before 2.0.192.0.19Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/vocab-runtime (npm)2.1.0 to before 2.1.152.1.15Patch availableGHSA-xw9q-2mv6-9fr8
—@fedify/vocab-runtime (npm)2.2.0 to before 2.2.42.2.4Patch availableGHSA-xw9q-2mv6-9fr8
  • fedify Vendorfedify-dev Affected 0.11.2 to before 1.9.12; 1.10.0 to before 1.10.11; 2.0.0 to before 2.0.19; 2.1.0 to before 2.1.15; 2.2.0 to before 2.2.4 Fixed in 1.9.12, 1.10.11, 2.0.19, 2.1.15, 2.2.4 Patch available CNA
  • vocab-runtime Vendorfedify-dev Affected before 2.0.19; 2.1.0 to before 2.1.15; 2.2.0 to before 2.2.4 Fixed in 2.0.19, 2.1.15, 2.2.4 Patch available CNA
  • @fedify/fedify (npm) Vendor— Affected 0.11.2 to before 1.9.12 Fixed in 1.9.12 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/fedify (npm) Vendor— Affected 1.10.0 to before 1.10.11 Fixed in 1.10.11 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/fedify (npm) Vendor— Affected 2.0.0 to before 2.0.19 Fixed in 2.0.19 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/fedify (npm) Vendor— Affected 2.1.0 to before 2.1.15 Fixed in 2.1.15 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/fedify (npm) Vendor— Affected 2.2.0 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/vocab-runtime (npm) Vendor— Affected before 2.0.19 Fixed in 2.0.19 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/vocab-runtime (npm) Vendor— Affected 2.1.0 to before 2.1.15 Fixed in 2.1.15 Patch available GHSA-xw9q-2mv6-9fr8
  • @fedify/vocab-runtime (npm) Vendor— Affected 2.2.0 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-xw9q-2mv6-9fr8

Remediation

  • Fix · CNA fedify (fedify-dev) Fixed in 1.9.12, 1.10.11, 2.0.19, 2.1.15, 2.2.4
  • Fix · CNA vocab-runtime (fedify-dev) Fixed in 2.0.19, 2.1.15, 2.2.4
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/fedify (npm) Fixed in 1.9.12 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/fedify (npm) Fixed in 1.10.11 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/fedify (npm) Fixed in 2.0.19 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/fedify (npm) Fixed in 2.1.15 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/fedify (npm) Fixed in 2.2.4 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/vocab-runtime (npm) Fixed in 2.0.19 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/vocab-runtime (npm) Fixed in 2.1.15 Advisory →
  • Fix · GHSA-xw9q-2mv6-9fr8 @fedify/vocab-runtime (npm) Fixed in 2.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50131
  2. 2026-10-03 Alias added: GHSA-xw9q-2mv6-9fr8

References

Advisory 1

Other 2

  • TI-2026-44926 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources CVSS 4.0HIGH 8.8
  • TI-2025-34622 @fedify/fedify: Improper Authentication and Incorrect Authorization CVSS 4.0HIGH 8.7
  • TI-2025-33806 Hollo renders posts received with form elements and allows submission CVSS 3.1MEDIUM 6.1
  • TI-2026-30750 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences