CVE-2026-62857 in fedify
Summary
by MITRE • 08/07/2026
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The Fedify library vulnerability represents a critical security flaw in the ActivityPub federated server implementation that affects multiple version lines from 1.2.0 through 2.3. This issue stems from insufficient input validation within the getNodeInfo() function which processes attacker-controlled URLs from the /.well-known/nodeinfo endpoint. The vulnerability manifests when the library follows links[].href values without proper scheme, redirect, or private-address validation mechanisms, creating an attack surface that allows malicious actors to manipulate network requests to internal services.
The technical flaw specifically resides in the lack of proper URL sanitization and validation procedures within the federated server framework. When the getNodeInfo() function processes node information from remote servers, it accepts href values that may contain loopback addresses such as 127.0.0.1 or ::1, link-local addresses like 169.254.0.0/16, cloud metadata endpoints such as 169.254.169.254, and private network ranges. This absence of validation creates a path for attackers to potentially access internal services that should remain isolated from external networks, effectively bypassing standard network segmentation controls.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables potential attackers to perform internal service enumeration and reconnaissance activities. An adversary could leverage this flaw to access cloud metadata services that often contain sensitive credentials, instance identifiers, and configuration data that could be used for further exploitation. The vulnerability aligns with CWE-20, "Improper Input Validation," and represents a classic case of insecure direct object reference where attacker-controlled input directly influences network requests.
From an attack perspective, this vulnerability maps to several ATT&CK techniques including T1071.004 for application layer protocol: DNS, T1566 for credential access through social engineering, and T1082 for system information discovery. The ability to traverse internal network boundaries without proper authentication or authorization creates a significant risk for organizations relying on Fedify for federated server applications, particularly in environments where cloud services and private networks coexist.
The remediation strategy involves implementing comprehensive URL validation mechanisms that reject URLs with invalid schemes, loopback addresses, link-local addresses, and private network ranges. This approach aligns with the principle of least privilege and defense-in-depth principles recommended by NIST SP 800-53. Organizations should ensure that all versions prior to the fixed releases 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2 are updated immediately, with particular attention to maintaining proper network segmentation and implementing additional monitoring for suspicious outbound requests from federated server instances.