@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-68475 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-68475 Source advisory: MEND:CVE-2025-68475...

@fedify/amqp (0.2.0-dev.12), @fedify/postgres (>=0.3.0-dev.20, <=0.3.0) +1 more potentially affected by CVE-2025-68475 via @fedify/fedify (>=0.10.2, <=1.5.0)

@fedify/fedify NPM version =0.10.2, =0.3.0-dev.20, =0.1.0-dev.4, =0.4.0 Source cves: CVE-2025-68475 Source advisory: MEND:CVE-2025-68475...

CVE-2025-68475 Fedify has ReDoS Vulnerability in HTML Parsing Regex

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service ReDoS vulnerability exists in Fedify's document loader. The HTML parsing regex at...

CVE-2025-68475 Fedify has ReDoS Vulnerability in HTML Parsing Regex

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service ReDoS vulnerability exists in Fedify's document loader. The HTML parsing regex at...

CVE-2025-68475

CVE-2025-68475 describes a ReDoS in Fedify's HTML document loader. A vulnerable regex in packages/fedify/src/runtime/docloader.ts uses nested quantifiers that enable catastrophic backtracking when parsing malicious HTML, potentially blocking the Node.js event loop. Affected versions are prior to ...

Fedify security vulnerabilities

Fedify is a TypeScript library by the individual developer Hong Minhee. It is used to build federated server applications supported by ActivityPub and other standards. A security vulnerability exists in Fedify versions prior to 1.6.13, 1.7.14, 1.8.15, and 1.9.2, which stems from a regular...

CVE-2025-68475: Inefficient Regular Expression Complexity

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service ReDoS vulnerability exists in Fedify's document loader. The HTML parsing regex at...

PT-2025-52723

Name of the Vulnerable Software and Affected Versions Fedify versions prior to 1.6.13 Fedify versions prior to 1.7.14 Fedify versions prior to 1.8.15 Fedify versions prior to 1.9.2 Description Fedify is a TypeScript library used for building federated server applications based on ActivityPub. A...

EUVD-2025-24039

Malicious code in bioql PyPI...

EUVD-2024-2391

Malicious code in bioql PyPI...

CVE-2025-54888

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass...

CVE-2025-54888

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-54888 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-54888 Source advisory: SNYK:JS-FEDIFYFEDIFY-11735306...

Improper Authentication

Overview @fedify/fedify is an An ActivityPub server framework Affected versions of this package are vulnerable to Improper Authentication via the handleInboxInternal function in the federation/handler.ts file. An attacker can impersonate any actor across all instances by sending forged activities...

@fedify/amqp (0.2.0-dev.12), @fedify/postgres (>=0.3.0-dev.20, <=0.3.0) +1 more potentially affected by CVE-2025-54888 via @fedify/fedify (>=1.5.0-dev.732, <=1.5.0)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2025-54888 Source advisory: SNYK:JS-FEDIFYFEDIFY-11735306...

CVE-2025-54888 @fedify/fedify: Improper Authentication and Incorrect Authorization

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass...

CVE-2025-54888 @fedify/fedify: Improper Authentication and Incorrect Authorization

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass...

@fedify/amqp (0.2.0-dev.12), @fedify/postgres (>=0.3.0-dev.20, <=0.3.0) +1 more potentially affected by CVE-2025-54888 via @fedify/fedify (>=1.5.0-dev.732, <=1.5.0)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2025-54888 Source advisory: MEND:CVE-2025-54888...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-54888 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-54888 Source advisory: MEND:CVE-2025-54888...

CVE-2025-54888

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass...