216.73.217.19

CVE-2026-34148

· Published 06/04/2026 16:16 · Modified 07/04/2026 15:17

Labels: CVE-2026-34148 2026-04-06CVE-2026-34148CWE-400[email protected]

Essential information

Published
06/04/2026 16:16
Modified
07/04/2026 15:17
Author
—
Creator
—
CVSS
7.5 HIGH (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS metrics

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

NVD status

Status
Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
fedify / fedify cpe:2.3:a:fedify:fedify:<1.9.6:*:*:*:*:*:*:*
fedify / fedify cpe:2.3:a:fedify:fedify:<1.10.5:*:*:*:*:*:*:*
fedify / fedify cpe:2.3:a:fedify:fedify:<2.0.8:*:*:*:*:*:*:*
fedify / fedify cpe:2.3:a:fedify:fedify:<2.1.1:*:*:*:*:*:*:*

References