vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-68475

Fedify has ReDoS Vulnerability in HTML Parsing Regex

HIGH
7.5
CVSS Score
Published: December 22, 2025 at 09:31 PM UTC
Updated: September 28, 2026 at 10:10 AM UTC
2 products affected across 2 vendors@fedifyFedify

Using fedify by fedify-dev?

Get instant alerts when new vulnerabilities affect fedify - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.6%
SSVC
PoC

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

@fedify· Fedify
95%
v < 1.6.131.7.0 ≤ v < 1.7.141.8.1 ≤ v < 1.8.151.9.0 ≤ v < 1.9.2
Affected range stops below 1.6.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.7.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.2, so it looks safe — our inference, not a vendor statement
Fedify· Fedify Dev
60%
v < 1.6.13v < 1.7.14v < 1.8.15v < 1.9.2
Affected range stops below 1.6.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.7.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.2, so it looks safe — our inference, not a vendor statement

References (7)

x_refsource_CONFIRMExploitMitigationVendor Advisory
Source: cverecord
https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93
x_refsource_MISCPatch
Source: cverecord
https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779
x_refsource_MISCPatch
Source: cverecord
https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a
x_refsource_MISCProductRelease Notes
Source: cverecord
https://github.com/fedify-dev/fedify/releases/tag/1.6.13
x_refsource_MISCProductRelease Notes
Source: cverecord
https://github.com/fedify-dev/fedify/releases/tag/1.7.14
x_refsource_MISCProductRelease Notes
Source: cverecord
https://github.com/fedify-dev/fedify/releases/tag/1.8.15
x_refsource_MISCProductRelease Notes
Source: cverecord
https://github.com/fedify-dev/fedify/releases/tag/1.9.2

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-1333

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card