Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@fedify/fedify

7 known vulnerabilities (6 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.4.5 (Oct 23, 2026): no advisory affects it
Newest unaffected release
2.4.5 (Oct 23, 2026), the latest release
Advisories
7 · 6 high, 1 medium
Weekly downloads
31.8K
Dependents
15
Releases
500+ since 1.9.6 (Mar 26, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-50131
    Affects 1.9.6-dev.2118 to 1.9.12-dev.2265 (1.9.12 is outside it); 1.10.4 to 1.10.10 (1.10.11 is outside it); 2.0.4 to 2.0.18 (2.0.19 is outside it); 2.1.0 to 2.1.14 (2.1.15 is outside it); 2.2.0 to 2.2.3 (2.2.4 is outside it)
  • CVE-2026-42462
    Affects 1.9.6-dev.2118 to 1.9.10 (1.9.11 is outside it); 1.10.4 to 1.10.9 (1.10.10 is outside it); 2.0.4 to 2.0.17 (2.0.18 is outside it); 2.1.0 to 2.1.13 (2.1.14 is outside it); 2.2.0 to 2.2.3-dev.1098 (2.2.3 is outside it)
  • CVE-2026-34148
    Affects 1.9.6-dev.2118 (1.9.6 is outside it); 1.10.4 (1.10.5 is outside it); 2.0.4 to 2.0.7 (2.0.8 is outside it); 2.1.0 (2.1.1 is outside it)
  • CVE-2025-68475
    No published release is affected
    No published release is affected
  • CVE-2025-54888
    No published release is affected
    No published release is affected
  • CVE-2025-23221
    No published release is affected
    No published release is affected
  • CVE-2024-39687
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 7

  • Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Affected: from 0.11.2, fixed in 1.9.12; from 1.10.0, fixed in 1.10.11; from 2.0.0, fixed in 2.0.19; from 2.1.0, fixed in 2.1.15; from 2.2.0, fixed in 2.2.4.

    Fixed in 1.9.12 (released Jun 4, 2026, 6 days before disclosure), 1.10.11 (released Jun 4, 2026, 6 days before disclosure), 2.0.19 (released Jun 4, 2026, 6 days before disclosure) and 2 other versions.

    The latest release, 2.4.5, is not affected.

    19% of @fedify/fedify downloads last week were affected versions (4.5K).

  • Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

    Affected: from 2.2.0, fixed in 2.2.3; from 2.1.0, fixed in 2.1.14; from 2.0.0, fixed in 2.0.18; from 1.10.0, fixed in 1.10.10; fixed in 1.9.11.

    Fixed in 1.9.11 (released May 20, 2026, 21 days before disclosure), 1.10.10 (released May 20, 2026, 21 days before disclosure), 2.0.18 (released May 20, 2026, 21 days before disclosure) and 2 other versions.

    The latest release, 2.4.5, is not affected.

    21% of @fedify/fedify downloads last week were affected versions (5K).

  • Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

    Affected: fixed in 1.9.6; from 1.10.0, fixed in 1.10.5; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.1.

    Fixed in 1.9.6 (released Mar 26, 2026, 11 days before disclosure), 1.10.5 (released Mar 26, 2026, 11 days before disclosure), 2.0.8 (released Mar 26, 2026, 11 days before disclosure) and 1 other version.

    The latest release, 2.4.5, is not affected.

    20% of @fedify/fedify downloads last week were affected versions (4.9K).

  • Fedify has ReDoS Vulnerability in HTML Parsing Regex

    Affected: fixed in 1.6.13; from 1.7.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.15; from 1.9.0, fixed in 1.9.2.

    Fixed in 1.6.13, 1.7.14, 1.8.15 and 1 other version.

    The latest release, 2.4.5, is not affected.

    18% of @fedify/fedify downloads last week were affected versions (4.4K).

  • @fedify/fedify: Improper Authentication and Incorrect Authorization

    Affected: fixed in 1.3.20; from 1.4.0-dev.585, fixed in 1.4.13; from 1.5.0-dev.636, fixed in 1.5.5; from 1.6.0-dev.754, fixed in 1.6.8; from 1.7.0-pr.251.885, fixed in 1.7.9; from 1.8.0-dev.909, fixed in 1.8.5.

    Fixed in 1.3.20, 1.4.13, 1.5.5 and 3 other versions.

    The latest release, 2.4.5, is not affected.

    13% of @fedify/fedify downloads last week were affected versions (3.2K).

  • CVE-2025-23221Medium 5.4

    Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism

    Affected: from 1.0.13, fixed in 1.0.14; from 1.1.10, fixed in 1.1.11; from 1.2.10, fixed in 1.2.11; from 1.3.3, fixed in 1.3.4.

    Fixed in 1.0.14, 1.1.11, 1.2.11 and 1 other version.

    The latest release, 2.4.5, is not affected.

    0.2% of @fedify/fedify downloads last week were affected versions (39).

  • Fedify vulnerable to allowing access to internal network resources

    Affected: fixed in 0.9.2; from 0.10.0, fixed in 0.10.2; from 0.11.0, fixed in 0.11.2.

    Fixed in 0.9.2, 0.10.2 and 0.11.2.

    The latest release, 2.4.5, is not affected.

    1.6% of @fedify/fedify downloads last week were affected versions (383).