CVE-2026-50131

Name of the Vulnerable Software and Affected Versions Fedify versions 0.11.2 through 1.9.11 Fedify versions 0.11.2 through 1.10.10 Fedify versions 0.11.2 through 2.0.18 Fedify versions 0.11.2 through 2.1.14 Fedify versions 0.11.2 through 2.2.3

Description Fedify is a TypeScript library for building federated server apps powered by ActivityPub. The software contains an incomplete mitigation for Server-Side Request Forgery (SSRF), which occurs when a server is tricked into making unauthorized requests to internal or restricted resources. The validatePublicUrl() function relies on isValidPublicIPv4Address() to reject non-public IPv4 destinations. While it blocks common private and local ranges, it incorrectly treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations, allowing potential bypasses of the SSRF defense during outbound fetches.

Recommendations Update to version 1.9.12 Update to version 1.10.11 Update to version 2.0.19 Update to version 2.1.15 Update to version 2.2.4