@fedify/botkit (>=0.4.0-dev.177, <=0.4.0-dev.181), @fedify/botkit-sqlite (>=0.4.0-dev.177, <=0.4.0-dev.181) potentially affected by CVE-2026-42462 via @fedify/fedify (1.10.0)

@fedify/fedify NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.177, =0.4.0-dev.177, =0.4.0-dev.181 Source cves: CVE-2026-42462 Source advisory:...

@fedify/botkit (>=0.4.0-dev.184, <=0.5.0-dev.198), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.5.0-dev.198) +1 more potentially affected by CVE-2026-42462 via @fedify/fedify (>=2.1.0, <=2.1.13)

@fedify/fedify NPM version =2.1.0, =0.4.0-dev.184, =0.4.0-dev.184, =2.1.0, =2.1.13 Source cves: CVE-2026-42462 Source advisory: SNYK:JS-FEDIFYFEDIFY-16895732...

@fedify/botkit (>=0.4.0-dev.177, <=0.4.0-dev.181), @fedify/botkit-sqlite (>=0.4.0-dev.177, <=0.4.0-dev.181) potentially affected by CVE-2026-42462 via @fedify/fedify (1.10.0)

@fedify/fedify NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.177, =0.4.0-dev.177, =0.4.0-dev.181 Source cves: CVE-2026-42462 Source advisory: GHSA-9RFG-V8G9-9367...

@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-42462 via @fedify/fedify (>=1.5.0-dev.732, <=1.9.2)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-42462 Source advisory: SNYK:JS-FEDIFYFEDIFY-16895732...

@fedify/cli (>=2.2.0, <=2.2.3-dev.1098) potentially affected by CVE-2026-42462 via @fedify/fedify (>=2.2.0, <=2.2.3-dev.1098)

@fedify/fedify NPM version =2.2.0, =2.2.0, =2.2.3-dev.1098 Source cves: CVE-2026-42462 Source advisory: OSV:GHSA-9RFG-V8G9-9367...

@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-42462 via @fedify/fedify (>=1.5.0-dev.732, <=1.9.2)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-42462 Source advisory: GHSA-9RFG-V8G9-9367...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +1 more potentially affected by CVE-2026-42462 via @fedify/fedify (>=2.0.0, <=2.0.17)

@fedify/fedify NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0, =2.0.17 Source cves: CVE-2026-42462 Source advisory: OSV:GHSA-9RFG-V8G9-9367...

@fedify/cli (>=2.2.0, <=2.2.3-dev.1098) potentially affected by CVE-2026-42462 via @fedify/fedify (>=2.2.0, <=2.2.3-dev.1098)

@fedify/fedify NPM version =2.2.0, =2.2.0, =2.2.3-dev.1098 Source cves: CVE-2026-42462 Source advisory: GHSA-9RFG-V8G9-9367...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-34148 via @fedify/vocab-runtime (>=2.0.0-dev.12, <=2.0.7)

@fedify/vocab-runtime NPM version =2.0.0-dev.12, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.0-dev.12, =2.0.0-dev.158, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.7 Source cves: CVE-2026-34148 Source advisory: OSV:GHSA-GM9M-GWC4-HWGP...

Allocation of Resources Without Limits or Throttling

Overview @fedify/vocab-runtime is a Runtime library for code-generated Activity Vocabulary APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the recursive handling of HTTP redirects in the remote and authenticated document loader...

EUVD-2026-19295

Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution...

@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-34148 via @fedify/fedify (>=1.5.0-dev.732, <=1.9.2)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-34148 Source advisory: GHSA-GM9M-GWC4-HWGP...

@fedify/botkit (>=0.4.0-dev.177, <=0.4.0-dev.181), @fedify/botkit-sqlite (>=0.4.0-dev.177, <=0.4.0-dev.181) potentially affected by CVE-2026-34148 via @fedify/fedify (1.10.0)

@fedify/fedify NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.177, =0.4.0-dev.177, =0.4.0-dev.181 Source cves: CVE-2026-34148 Source advisory:...

@fedify/botkit (>=0.4.0-dev.184, <=0.4.0-dev.185), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.4.0-dev.185) +5 more potentially affected by CVE-2026-34148 via @fedify/vocab-runtime (2.1.0)

@fedify/vocab-runtime NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/vocab-runtime and may be impacted: - @fedify/botkit =0.4.0-dev.184, =0.4.0-dev.184, =0.4.0-dev.185 - @fedify/cli 2.1.0 - @fedify/fedify 2.1.0 - @fedify/rela...

@fedify/botkit (>=0.4.0-dev.177, <=0.4.0-dev.181), @fedify/botkit-sqlite (>=0.4.0-dev.177, <=0.4.0-dev.181) potentially affected by CVE-2026-34148 via @fedify/fedify (1.10.0)

@fedify/fedify NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.177, =0.4.0-dev.177, =0.4.0-dev.181 Source cves: CVE-2026-34148 Source advisory: OSV:GHSA-GM9M-GWC4-HWGP...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-34148 via @fedify/vocab-runtime (>=2.0.0-dev.12, <=2.0.7)

@fedify/vocab-runtime NPM version =2.0.0-dev.12, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.0-dev.12, =2.0.0-dev.158, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.7 Source cves: CVE-2026-34148 Source advisory: GHSA-GM9M-GWC4-HWGP...

@fedify/botkit (>=0.4.0-dev.184, <=0.4.0-dev.185), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.4.0-dev.185) +1 more potentially affected by CVE-2026-34148 via @fedify/fedify (2.1.0)

@fedify/fedify NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.184, =0.4.0-dev.184, =0.4.0-dev.185 - @fedify/cli 2.1.0 Source cves: CVE-2026-34148 Source advisory:...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +1 more potentially affected by CVE-2026-34148 via @fedify/fedify (>=2.0.0, <=2.0.7)

@fedify/fedify NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0, =2.0.7 Source cves: CVE-2026-34148 Source advisory: OSV:GHSA-GM9M-GWC4-HWGP...

@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-34148 via @fedify/fedify (>=1.5.0-dev.732, <=1.9.2)

@fedify/fedify NPM version =1.5.0-dev.732, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-34148 Source advisory: SNYK:JS-FEDIFYFEDIFY-15928876...

@fedify/botkit (>=0.4.0-dev.184, <=0.4.0-dev.185), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.4.0-dev.185) +1 more potentially affected by CVE-2026-34148 via @fedify/fedify (2.1.0)

@fedify/fedify NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.184, =0.4.0-dev.184, =0.4.0-dev.185 - @fedify/cli 2.1.0 Source cves: CVE-2026-34148 Source advisory:...