Skip to content
Fencer Vulns
high 7.5

CVE-2026-34148 json

Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

published 2026-04-06 7 mo ago modified 2026-10-26 13 d ago also GHSA-gm9m-gwc4-hwgp , EUVD-2026-19295

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

Patch / fix

  • npm @fedify/fedify 1.9.6, 1.10.5, 2.0.8, 2.1.1
  • npm @fedify/vocab-runtime 2.0.8, 2.1.1
  • fedify fedify/fedify 1.9.6, 1.10.5, 2.0.8, 2.1.1
  • fedify fedify/vocab-runtime 2.0.8, 2.1.1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm @fedify/fedify
<1.9.6
>=1.10.0, <1.10.5
>=2.0.0, <2.0.8
>=2.1.0, <2.1.1
1.9.6
1.10.5
2.0.8
2.1.1
npm @fedify/vocab-runtime
<2.0.8
>=2.1.0, <2.1.1
2.0.8
2.1.1

Affected products

  • @fedify fedify
  • @fedify vocab-runtime

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.