CVE-2026-62857 Details
Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
A server-side request forgery (SSRF) vulnerability has been identified in the Fedify TypeScript library, specifically in versions 1.2.0 prior to 1.9.0, as well as in the 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines. The vulnerability arises in the `getNodeInfo()` function, which fetches the NodeInfo document URL from a remote server's `/.well-known/nodeinfo` response without validating that the URL points to a public address. This flaw allows attackers to manipulate the response and direct Fedify to access internal network resources, such as loopback, link-local, cloud metadata, and private-network services, potentially exposing sensitive information. The issue has been patched in Fedify versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
Users can upgrade to Fedify versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, or 2.3.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/fedify-dev/fedify/releases/tag/2.3.2 | [email protected] | Release NotesVendor |
| https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fedify | >= 1.2.0, <= 2.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |