CVE-2026-50131: Server-Side Request Forgery Validation Bypass in Fedify
Vulnerability ID: CVE-2026-50131
CVSS Score: 8.6
Published: 2026-07-14
Fedify, a TypeScript framework for ActivityPub servers, implemented incomplete public URL validation inside the @fedify/fedify and @fedify/vocab-runtime libraries. The validator only blocked basic RFC 1918 networks, standard loopbacks, and link-local addresses, failing to restrict Carrier-Grade NAT (CGNAT), benchmarking, reserved, or IPv6 transition addresses. Consequently, unauthenticated remote attackers can bypass SSRF filters to access sensitive internal microservices and endpoints.
TL;DR
Incomplete IP validation in Fedify enables unauthenticated remote attackers to bypass SSRF protections and access internal services by using CGNAT, benchmarking, and IPv6 transition IP addresses.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-918
- Attack Vector: Network (AV:N)
- CVSS Score: 8.6
- EPSS Score: 0.00269 (0.269%)
- Impact: High Confidentiality, Low Integrity, Low Availability
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Fedify
- @fedify/fedify
- @fedify/vocab-runtime
-
@fedify/fedify: >= 0.11.2, < 1.9.12 (Fixed in:
1.9.12) -
@fedify/fedify: >= 1.10.0, < 1.10.11 (Fixed in:
1.10.11) -
@fedify/fedify: >= 2.0.0, < 2.0.19 (Fixed in:
2.0.19) -
@fedify/fedify: >= 2.1.0, < 2.1.15 (Fixed in:
2.1.15) -
@fedify/fedify: >= 2.2.0, < 2.2.4 (Fixed in:
2.2.4) -
@fedify/vocab-runtime: < 2.0.19 (Fixed in:
2.0.19) -
@fedify/vocab-runtime: >= 2.1.0, < 2.1.15 (Fixed in:
2.1.15) -
@fedify/vocab-runtime: >= 2.2.0, < 2.2.4 (Fixed in:
2.2.4)
Code Analysis
Commit: c5b46f8
Harden public URL address validation
Exploit Details
- GitHub: Proof-of-Concept documentation and vulnerability index
Mitigation Strategies
- Upgrade Fedify and Vocab-Runtime packages immediately
- Enforce network-level egress blocking for private subnets
- Pin HTTP requests strictly to validated IP addresses to prevent DNS rebinding
Remediation Steps:
- Audit the current codebase dependencies using package-lock.json or pnpm-lock.yaml for vulnerable versions of @fedify/fedify (< 1.9.12, < 1.10.11, < 2.0.19, < 2.1.15, < 2.2.4).
- Update the dependency configuration to specify secure, patched versions.
- Deploy the updated software to production servers.
- Configure network edge routers and container configurations to drop outbound traffic originating from application servers directed to private or CGNAT addresses.
References
- GitHub Security Advisory GHSA-xw9q-2mv6-9fr8
- GitHub Repository - CVE-2026-50131 Analysis and PoC Index
Read the full report for CVE-2026-50131 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)