CVE-2026-34148

Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

HIGH

7.5

CVSS Score

Published: April 6, 2026 at 03:06 PM UTC

Updated: October 26, 2026 at 10:10 PM UTC

4 products affected across 1 vendorFedify /fedifyFedify /vocab Runtime@fedify

Using fedify by @fedify?

Get instant alerts when new vulnerabilities affect fedify - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.6%

SSVC

PoC

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedify /fedify · Fedify

95%

v < 1.9.61.10.0 ≤ v < 1.10.52.0.0 ≤ v < 2.0.82.1.0 ≤ v < 2.1.1

Fedify /vocab Runtime · Fedify

95%

v < 2.0.82.1.0 ≤ v < 2.1.1

@fedify · Fedify

90%

v < 1.9.61.10.0 ≤ v < 1.10.52.0.0 ≤ v < 2.0.82.1.0 ≤ v < 2.1.1

Affected range stops below 1.10.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.9.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.1, so it looks safe — our inference, not a vendor statement

Vocab Runtime · Fedify

90%

v < 2.0.82.1.0 ≤ v < 2.1.1

Affected range stops below 2.0.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp

References (5)

x_refsource_CONFIRMExploitVendor Advisory

Source: cverecord

https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp

x_refsource_MISCRelease Notes

Source: cverecord

https://github.com/fedify-dev/fedify/releases/tag/1.10.5

x_refsource_MISCRelease Notes

Source: cverecord

https://github.com/fedify-dev/fedify/releases/tag/1.9.6

x_refsource_MISCRelease Notes

Source: cverecord

https://github.com/fedify-dev/fedify/releases/tag/2.0.8

x_refsource_MISCRelease Notes

Source: cverecord

https://github.com/fedify-dev/fedify/releases/tag/2.1.1

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHGitHub_M

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-400CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card