BotKit by Fedify

BotKit security updates: 0.4.11 and 0.5.8

A critical DNS rebinding vulnerability in Fedify exposes BotKit deployments to server-side request forgery (SSRF), enabling attackers to reach internal network services. The flaw stems from validating hostnames against public IP addresses before allowing network requests to resolve the DNS record a second time, leaving remote document loading, activity delivery, and WebFinger lookups susceptible to malicious redirect or resolution manipulation. Addressing the issue on Node.js and Bun requires upgrading to BotKit 0.4.11 or 0.5.8, alongside specific runtime version requirements to pin verified connection targets properly. Because Deno cannot pin connections in the same manner, applications running on Deno require runtime network flags or network-level firewall restrictions to block private ranges entirely. Understanding these runtime-specific mitigation requirements is essential to securing federated services against unauthorized internal network access.

Read full article

BotKit security updates: 0.4.10 and 0.5.7

Critical security vulnerabilities in the underlying Fedify framework expose BotKit deployments to forged object delivery, activity suppression, and unauthorized actor authentication. The flaws enable attackers without local accounts to exploit relaxed origin matching between activities and actors, as well as bypass key ownership validations via redirects or alternate actor documents. Patches have been delivered across supported branches to strictly enforce origin checks and mandate exact document identity matches before processing or caching incoming federated activities. Resolving these risks requires updating dependencies, redeploying running instances, and clearing custom key caches to prevent persistence of compromised ownership records. Understanding the precise attack vectors and remediation requirements ensures federated services remain resilient against identity spoofing and payload injection.

Read full article

BotKit security updates: 0.4.7 and 0.5.4

BotKit has issued urgent security releases to remediate three vulnerabilities stemming from its underlying Fedify dependency, led by a critical actor impersonation flaw (CVE-2026-96625) that allows arbitrary attackers to forge activities under any identity due to unverified signing key ownership claims. The update also addresses high-severity denial-of-service risks from unbounded remote JSON parsing (CVE-2026-96623) by enforcing a 16 MiB post-decompression payload limit, alongside server-side request forgery weaknesses in outbound activity delivery paths (CVE-2026-96624) by validating initial destination and redirect targets. Upgrading immediately to BotKit 0.4.7 or 0.5.4—and clearing any custom key caches—is vital to protecting federated bots from complete identity spoofing and internal network exploitation.

Read full article

BotKit security updates: 0.4.6 and 0.5.2

BotKit has released security updates to address two vulnerabilities from its Fedify dependency, CVE-2026-77632 and CVE-2026-69132. The high-severity flaw is a blind server-side request forgery (SSRF) where unvalidated HTTP redirect targets in the authenticated document loader can expose private network addresses. Additionally, a medium-severity denial-of-service (DoS) vulnerability in the outbound delivery circuit breaker allows attackers to exhaust storage by inflating state records. Upgrading to BotKit 0.4.6 or 0.5.2 resolves these issues by validating redirect URLs and bounding state lifespans. Applying these patches is essential for protecting federated applications from unauthorized internal requests and resource exhaustion.

Read full article

BotKit security updates: 0.4.5 and 0.5.1

A security vulnerability, CVE-2026-62857, affects BotKit applications due to a flaw in Fedify's NodeInfo client. The issue arises during remote server lookups where unvalidated redirect destinations can allow attackers to point requests toward non-public network resources, including loopback and local addresses. A fix has been implemented to enforce public-address validation, restrict redirect hops, and reject non-HTTP(S) protocols. Upgrading to BotKit version 0.4.5 or 0.5.1 secures applications against unauthorized internal network access.

Read full article