PT-2026-43443 · Npm+2 · @Fedify/Fedify+1
CVE-2026-42462
·
Published
2026-05-26
·
Updated
2026-06-11
CVSS v3.1
7.0
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Fedify versions prior to 1.9.11
Fedify versions prior to 1.10.10
Fedify versions prior to 2.0.18
Fedify versions prior to 2.1.14
Fedify versions prior to 2.2.3
Description
An attacker can utilize JSON-LD features to restructure a JSON-LD document, altering how it is interpreted without changing its Linked Data Signature. This allows the modification of third-party signed activities. The issue arises because signatures are based on the canonical RDF graph representation, while JSON-LD provides multiple ways to represent the same graph.
Technical details include:
- The
@graphand@reversekeywords can be used to change the root activity or reverse anActivityand itsobject, potentially causing implementations to process the wrong object. - The
@includedkeyword can move properties outside the normal tree, making them invisible to most implementations and allowing the removal of statuses or actor properties inCreateorUpdateactivities. - A failure to compact JSON-LD documents against a local context allows attackers to use non-standard aliases to replace existing values, enabling the forgery of activities and the replacement of arbitrary portions of a signed document, such as an actor's
inbox.
Recommendations
Update to version 1.9.11.
Update to version 1.10.10.
Update to version 2.0.18.
Update to version 2.1.14.
Update to version 2.2.3.
As a mitigation measure, reject JSON-LD payloads containing the
@graph, @included, or @reverse keywords after compacting the activity to the local context.Exploit
Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Fedify/Fedify
Fedify