fedify-dev fedify up to 2.2.2 LD Feature validate before canonicalize

Summaryinfo

A vulnerability identified as problematic has been detected in fedify-dev fedify up to 1.9.10/1.10.9/2.0.17/2.1.13/2.2.2. This affects an unknown function of the component LD Feature. Performing a manipulation results in validate before canonicalize. This vulnerability was named CVE-2026-42462. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in fedify-dev fedify up to 1.9.10/1.10.9/2.0.17/2.1.13/2.2.2. This affects some unknown functionality of the component LD Feature. The manipulation with an unknown input leads to a validate before canonicalize vulnerability. CWE is classifying the issue as CWE-180. The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-42462 since 04/27/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.9.11, 1.10.10, 2.0.18, 2.1.14 or 2.2.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• fedify-dev

Name

• fedify

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.10.8
• 1.10.9
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.2.0
• 2.2.1
• 2.2.2

Website

• Product: https://github.com/fedify-dev/fedify/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion