Fedify

Fedify security updates: 2.0.35, 2.1.31, 2.2.20, 2.3.15, and 2.4.5

Fedify has patched two server-side request forgery (SSRF) vulnerabilities across its supported release lines: a medium-severity DNS rebinding flaw that bypassed private address checks during outbound network requests, and a low-severity issue in the CLI where unvalidated page and favicon lookups could target internal endpoints. The core DNS rebinding vulnerability stems from resolving hostnames separately during validation and connection phases, leaving operations like document loading, activity delivery, and WebFinger lookups susceptible to reaching private networks. While Node.js and Bun pin validated addresses directly—with specific version considerations for proxying and certificate checks on Bun—Deno environments cannot pin connections and require network-level mitigations such as specific permission flags or container firewalls. Operators must also upgrade the CLI tool separately or utilize flags to disable risky requests. Understanding these runtime nuances and version requirements is crucial for ensuring internal network boundaries remain thoroughly protected against SSRF exploits.

Read full article

Fedify security updates: 2.0.34, 2.1.30, 2.2.19, 2.3.14, and 2.4.4

Critical security vulnerabilities have been patched in the `@fedify/fedify` package, addressing flaws in inbox origin validation and actor key ownership verification. The first vulnerability, GHSA-4qhx-hhwf-8685, allowed attackers to provide forged embedded objects or suppress genuine activities through idempotency cache abuse due to missing origin checks between activity IDs and their actors. The second vulnerability, GHSA-8863-8468-7hq7, allowed improper authentication under specific actor document redirect or alternate-document configurations when dereferencing keys. Fixes have rolled out across versions 2.0.34, 2.1.30, 2.2.19, 2.3.14, and 2.4.4, enforcing strict origin matching and document ID equality while automatically invalidating affected built-in cache entries. Upgrading immediately and clearing any custom key caches is essential to protecting Fedify-powered federated applications from activity suppression and identity spoofing.

Read full article

DrFed 0.1.0: Our first release

DrFed 0.1.0 marks the initial MVP release of a web-based platform designed for developing and debugging ActivityPub implementations. Built by the Fedify team with support from NLnet and the NGI0 Commons Fund, this early version allows developers to run local test environments, generate actors, store ActivityPub objects, and inspect incoming JSON-LD deliveries through an activity log. Distributed via npm for Node.js environments, the suite provides four core CLI utilities with embedded PGlite support for quick local setups as well as PostgreSQL compatibility for broader deployments. While advanced debugging utilities like signature validators and automated remote activity dispatching remain in development, this release establishes a functional testing foundation for federation developers to explore and provide early feedback.

Read full article

Fedify security updates: 2.0.30, 2.1.26, 2.2.15, 2.3.10, and 2.4.0

Fedify has released security updates addressing two vulnerabilities: an unbounded alternate-document fetch chain issue that allows attackers to trigger indefinite HTTP loops to exhaust server resources, and a routing flaw where unverified activity documents could bypass dereference verification. The patches introduce a strict 20-hop limit across redirects, preserve fetch cancellation signals, and ensure that dereferenced activities properly replace unverified JSON-LD documents during inbox routing. Upgrading Fedify across affected 2.x versions and migrating from 1.x is critical to securing federated servers against resource exhaustion and spoofed payload processing.

Read full article