CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

CVE-2026-62857: Server-Side Request Forgery (SSRF)

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

PT-2026-68760

Name of the Vulnerable Software and Affected Versions Fedify versions 1.2.0 through 1.9.12 Fedify versions 1.10.0 through 1.10.11 Fedify versions 2.0.0 through 2.0.21 Fedify versions 2.1.0 through 2.1.17 Fedify versions 2.2.0 through 2.2.6 Fedify versions 2.3.0 through 2.3.1 Description The...