Vulnerabilities

TI-2026-26449 CVE-2026-34148 · GHSA-gm9m-gwc4-hwgp

Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

HIGH 72

Fedify is a TypeScript library for building federated server apps powered by ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00572 Published 2026-04-06 Fixed in 1.9.6, 1.10.5 +2 CWE-400

TI-2026-20871 CVE-2026-25808

HIGH 72

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00489 Published 2026-02-09 Fixed in 0.7.2 CWE-862

TI-2025-42005 CVE-2025-68475 · GHSA-rchf-xwx2-hm93

HIGH 72

Fedify is a TypeScript library for building federated server apps powered by ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00559 Published 2025-12-22 Fixed in 1.6.13, 1.7.14 +2 CWE-1333