Fedify

Fedify security updates: 2.0.28, 2.1.24, 2.2.13, and 2.3.8

Fedify has released crucial security patches across its 2.x versions to resolve three distinct vulnerabilities, led by a critical actor impersonation flaw (CVE-2026-96625) that permitted attackers to forge activity signatures and bypass authorized fetch controls. The updates also address a high-severity denial-of-service vulnerability caused by unbounded JSON document parsing (CVE-2026-96623) by implementing a 16 MiB post-decompression limit, alongside a medium-severity server-side request forgery vulnerability (CVE-2026-96624) in outbound activity deliveries. Deployments using affected Fedify releases must upgrade immediately to patched versions and clear custom key caches to prevent unauthorized access, resource exhaustion, and internal network exposure.

Read full article

Fedify security updates: 2.0.26, 2.1.22, 2.2.11, and 2.3.6

Critical security updates for `@fedify/fedify` address a high-severity server-side request forgery (SSRF) and a medium-severity denial-of-service (DoS) vulnerability. The SSRF flaw in the authenticated document loader allows attackers to bypass validation and redirect signed HTTP requests to internal networks, while the DoS flaw exploits the outbound delivery circuit breaker to exhaust server storage. To secure affected deployments, the latest versions introduce validated redirect targets and bounded default lifetimes for custom failure policies. Reviewing these vulnerabilities and upgrading your dependencies immediately is essential for securing your federated applications.

Read full article

Fedify security updates: 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2

Fedify has released critical security patches to address CVE-2026-62857, a vulnerability in its NodeInfo client that allows attackers to trigger requests to non-public network destinations. The flaw in getNodeInfo and Context.lookupNodeInfo allows a remote server to redirect requests to internal loopback, link-local, or RFC 1918 addresses. The patched releases resolve this by applying strict public-address validation to NodeInfo lookups and redirects. Applying these updates is vital for safeguarding federated servers against unauthorized internal network exposure.

Read full article