Read the docs
TI-2026-44926 Aliases CVE-2026-62857

Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Priority HIGH 77CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed fedify (fedify-dev): 1.9.13, 1.10.12, 2.0.22 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fedify-devfedify1.2.0 to before 1.9.13; 1.10.0 to before 1.10.12; 2.0.0 to before 2.0.22; 2.1.0 to before 2.1.18; 2.2.0 to before 2.2.7; 2.3.0 to before 2.3.21.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2Patch availableCNA
  • fedify Vendorfedify-dev Affected 1.2.0 to before 1.9.13; 1.10.0 to before 1.10.12; 2.0.0 to before 2.0.22; 2.1.0 to before 2.1.18; 2.2.0 to before 2.2.7; 2.3.0 to before 2.3.2 Fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2 Patch available CNA

Remediation

  • Fix · CNA fedify (fedify-dev) Fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62857

References

Other 2

  • TI-2025-34622 @fedify/fedify: Improper Authentication and Incorrect Authorization CVSS 4.0HIGH 8.7
  • TI-2026-36902 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVSS 3.1HIGH 8.6
  • TI-2025-33806 Hollo renders posts received with form elements and allows submission CVSS 3.1MEDIUM 6.1
  • TI-2026-30750 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences