Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@fedify/vocab-runtime

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
2.4.5 (Oct 23, 2026): no advisory affects it
Newest unaffected release
2.4.5 (Oct 23, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
26.6K
Dependents
21
Releases
500+ since 2.0.0 (Feb 22, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-50131
    Affects 2.0.0-dev.323 to 2.0.18 (2.0.19 is outside it); 2.1.0 to 2.1.14 (2.1.15 is outside it); 2.2.0 to 2.2.3 (2.2.4 is outside it)
  • CVE-2026-34148
    Affects 2.0.0-dev.323 to 2.0.7 (2.0.8 is outside it); 2.1.0 (2.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Affected: fixed in 2.0.19; from 2.1.0, fixed in 2.1.15; from 2.2.0, fixed in 2.2.4.

    Fixed in 2.0.19 (released Jun 4, 2026, 6 days before disclosure), 2.1.15 (released Jun 4, 2026, 6 days before disclosure) and 2.2.4 (released Jun 4, 2026, 6 days before disclosure).

    The latest release, 2.4.5, is not affected.

    4.2% of @fedify/vocab-runtime downloads last week were affected versions (824).

  • Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

    Affected: fixed in 2.0.8; from 2.1.0, fixed in 2.1.1.

    Fixed in 2.0.8 (released Mar 26, 2026, 11 days before disclosure) and 2.1.1 (released Mar 26, 2026, 11 days before disclosure).

    The latest release, 2.4.5, is not affected.

    3.6% of @fedify/vocab-runtime downloads last week were affected versions (711).