CVE-2025-68475

Name of the Vulnerable Software and Affected Versions Fedify versions prior to 1.6.13 Fedify versions prior to 1.7.14 Fedify versions prior to 1.8.15 Fedify versions prior to 1.9.2

Description Fedify is a TypeScript library used for building federated server applications based on ActivityPub. A Regular Expression Denial of Service (ReDoS) issue exists in the document loader component. The HTML parsing regular expression located at packages/fedify/src/runtime/docloader.ts:259 includes nested quantifiers that can lead to catastrophic backtracking when processing specially crafted HTML responses. This can cause a denial of service.

Recommendations Update to Fedify version 1.6.13 or later. Update to Fedify version 1.7.14 or later. Update to Fedify version 1.8.15 or later. Update to Fedify version 1.9.2 or later.