CVE-2026-62857

Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

HIGH

8.8

CVSS Score

Published: August 6, 2026 at 09:04 PM UTC

Updated: October 24, 2026 at 04:10 PM UTC

1 product affected across 1 vendorFedify

Using fedify by fedify-dev?

Get instant alerts when new vulnerabilities affect fedify - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.4%

SSVC

PoC

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedify · Fedify Dev

90%

>= 1.10.0, < 1.10.12>= 1.2.0, < 1.9.13>= 2.0.0, < 2.0.22>= 2.1.0, < 2.1.18>= 2.2.0, < 2.2.7>= 2.3.0, < 2.3.2

Affected range stops below 1.10.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.9.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.2.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.3.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_MISC

Source: [email protected]

https://github.com/fedify-dev/fedify/releases/tag/2.3.2

x_refsource_CONFIRM

Source: [email protected]

https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHGitHub_M

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-918

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card