CVE-2026-42462 Details

A vulnerability exists in Fedify, a TypeScript library for building federated server applications using ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker could exploit JSON-LD features to manipulate the structure of a JSON-LD document. This manipulation could alter how Fedify interpreted the document without invalidating its Linked Data Signature, enabling the attacker to modify a third-party signed activity. The issue arises because the signature is applied to the canonical RDF graph representation of the JSON-LD, and JSON-LD allows multiple representations of the same graph. Exploitation could involve using the '@graph', '@included', or '@reverse' keywords to change the interpretation of signed activities, potentially leading to unauthorized modifications of activity data.

Users can upgrade to Fedify versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, or 2.2.3, all of which address this vulnerability.