# @fedify/fedify (npm) vulnerabilities 7 known vulnerabilities (6 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.4.5 (Oct 23, 2026): no advisory affects it - Newest unaffected release: 2.4.5 (Oct 23, 2026), the latest release - Weekly downloads: 31.8K - Dependents: 15 - Releases: 500+ since 1.9.6 (Mar 26, 2026) - Registry: https://www.npmjs.com/package/@fedify/fedify - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-50131: 1.9.6-dev.2118 to 1.9.12-dev.2265 (1.9.12 is outside it); 1.10.4 to 1.10.10 (1.10.11 is outside it); 2.0.4 to 2.0.18 (2.0.19 is outside it); 2.1.0 to 2.1.14 (2.1.15 is outside it); 2.2.0 to 2.2.3 (2.2.4 is outside it) - CVE-2026-42462: 1.9.6-dev.2118 to 1.9.10 (1.9.11 is outside it); 1.10.4 to 1.10.9 (1.10.10 is outside it); 2.0.4 to 2.0.17 (2.0.18 is outside it); 2.1.0 to 2.1.13 (2.1.14 is outside it); 2.2.0 to 2.2.3-dev.1098 (2.2.3 is outside it) - CVE-2026-34148: 1.9.6-dev.2118 (1.9.6 is outside it); 1.10.4 (1.10.5 is outside it); 2.0.4 to 2.0.7 (2.0.8 is outside it); 2.1.0 (2.1.1 is outside it) - CVE-2025-68475: no published release is affected - CVE-2025-54888: no published release is affected - CVE-2025-23221: no published release is affected - CVE-2024-39687: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (7) ### [CVE-2026-50131](https://cve.now/CVE-2026-50131): Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges - Severity: High 8.6 - Published: Jun 10, 2026 - Affected: from 0.11.2, fixed in 1.9.12; from 1.10.0, fixed in 1.10.11; from 2.0.0, fixed in 2.0.19; from 2.1.0, fixed in 2.1.15; from 2.2.0, fixed in 2.2.4. - Fixed in 1.9.12 (released Jun 4, 2026, 6 days before disclosure), 1.10.11 (released Jun 4, 2026, 6 days before disclosure), 2.0.19 (released Jun 4, 2026, 6 days before disclosure) and 2 other versions. - The latest release, 2.4.5, is not affected. - 19% of @fedify/fedify downloads last week were affected versions (4.5K). ### [CVE-2026-42462](https://cve.now/CVE-2026-42462): Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring - Severity: High 7.0 - Published: Jun 10, 2026 - Affected: from 2.2.0, fixed in 2.2.3; from 2.1.0, fixed in 2.1.14; from 2.0.0, fixed in 2.0.18; from 1.10.0, fixed in 1.10.10; fixed in 1.9.11. - Fixed in 1.9.11 (released May 20, 2026, 21 days before disclosure), 1.10.10 (released May 20, 2026, 21 days before disclosure), 2.0.18 (released May 20, 2026, 21 days before disclosure) and 2 other versions. - The latest release, 2.4.5, is not affected. - 21% of @fedify/fedify downloads last week were affected versions (5K). ### [CVE-2026-34148](https://cve.now/CVE-2026-34148): Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - Severity: High 7.5 - Published: Apr 6, 2026 - Affected: fixed in 1.9.6; from 1.10.0, fixed in 1.10.5; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.1. - Fixed in 1.9.6 (released Mar 26, 2026, 11 days before disclosure), 1.10.5 (released Mar 26, 2026, 11 days before disclosure), 2.0.8 (released Mar 26, 2026, 11 days before disclosure) and 1 other version. - The latest release, 2.4.5, is not affected. - 20% of @fedify/fedify downloads last week were affected versions (4.9K). ### [CVE-2025-68475](https://cve.now/CVE-2025-68475): Fedify has ReDoS Vulnerability in HTML Parsing Regex - Severity: High 7.5 - Published: Dec 22, 2025 - Affected: fixed in 1.6.13; from 1.7.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.15; from 1.9.0, fixed in 1.9.2. - Fixed in 1.6.13, 1.7.14, 1.8.15 and 1 other version. - The latest release, 2.4.5, is not affected. - 18% of @fedify/fedify downloads last week were affected versions (4.4K). ### [CVE-2025-54888](https://cve.now/CVE-2025-54888): @fedify/fedify: Improper Authentication and Incorrect Authorization - Severity: High 8.7 - Published: Aug 9, 2025 - Affected: fixed in 1.3.20; from 1.4.0-dev.585, fixed in 1.4.13; from 1.5.0-dev.636, fixed in 1.5.5; from 1.6.0-dev.754, fixed in 1.6.8; from 1.7.0-pr.251.885, fixed in 1.7.9; from 1.8.0-dev.909, fixed in 1.8.5. - Fixed in 1.3.20, 1.4.13, 1.5.5 and 3 other versions. - The latest release, 2.4.5, is not affected. - 13% of @fedify/fedify downloads last week were affected versions (3.2K). ### [CVE-2025-23221](https://cve.now/CVE-2025-23221): Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism - Severity: Medium 5.4 - Published: Jan 20, 2025 - Affected: from 1.0.13, fixed in 1.0.14; from 1.1.10, fixed in 1.1.11; from 1.2.10, fixed in 1.2.11; from 1.3.3, fixed in 1.3.4. - Fixed in 1.0.14, 1.1.11, 1.2.11 and 1 other version. - The latest release, 2.4.5, is not affected. - 0.2% of @fedify/fedify downloads last week were affected versions (39). ### [CVE-2024-39687](https://cve.now/CVE-2024-39687): Fedify vulnerable to allowing access to internal network resources - Severity: High 7.2 - Published: Jul 5, 2024 - Affected: fixed in 0.9.2; from 0.10.0, fixed in 0.10.2; from 0.11.0, fixed in 0.11.2. - Fixed in 0.9.2, 0.10.2 and 0.11.2. - The latest release, 2.4.5, is not affected. - 1.6% of @fedify/fedify downloads last week were affected versions (383). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@fedify/fedify Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.