CVE-2026-62857

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/fedify-dev/fedify/releases/tag/2.3.2
https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5
https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Fedify es una biblioteca TypeScript para construir aplicaciones de servidor federadas impulsadas por ActivityPub. Desde la versión 1.2.0 hasta las líneas de mantenimiento afectadas 1.9, 1.10, 2.0, 2.1, 2.2 y 2.3, getNodeInfo() sigue un valor links[].href controlado por el atacante desde /.well-known/nodeinfo sin validación de esquema, redirección o dirección privada, permitiendo solicitudes a servicios de loopback, link-local, metadatos en la nube y de red privada y devolviendo sus cuerpos de respuesta. Este problema está solucionado en las versiones 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7 y 2.3.2.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-62857

Mitre link : CVE-2026-62857

CVE.ORG link : CVE-2026-62857

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-62857", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62857", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-08T02:39:56.206189Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fedify-dev", "product": "fedify", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.9.13"}, {"status": "affected", "version": ">= 1.10.0, < 1.10.12"}, {"status": "affected", "version": ">= 2.0.0, < 2.0.22"}, {"status": "affected", "version": ">= 2.1.0, < 2.1.18"}, {"status": "affected", "version": ">= 2.2.0, < 2.2.7"}, {"status": "affected", "version": ">= 2.3.0, < 2.3.2"}]}]}], "published": "2026-08-06T22:18:12.127", "references": [{"url": "https://github.com/fedify-dev/fedify/releases/tag/2.3.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5", "source": "security-advisories@github.com"}, {"url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2."}, {"lang": "es", "value": "Fedify es una biblioteca TypeScript para construir aplicaciones de servidor federadas impulsadas por ActivityPub. Desde la versi\u00f3n 1.2.0 hasta las l\u00edneas de mantenimiento afectadas 1.9, 1.10, 2.0, 2.1, 2.2 y 2.3, getNodeInfo() sigue un valor links[].href controlado por el atacante desde /.well-known/nodeinfo sin validaci\u00f3n de esquema, redirecci\u00f3n o direcci\u00f3n privada, permitiendo solicitudes a servicios de loopback, link-local, metadatos en la nube y de red privada y devolviendo sus cuerpos de respuesta. Este problema est\u00e1 solucionado en las versiones 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7 y 2.3.2."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}