CVE-2026-50131
Received Received - Intake
SSRF Bypass via IPv4 Validation in Fedify

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: GitHub, Inc.

Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2026-50131
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
fedify fedify to 2.2.4 (exc)
fedify fedify 1.9.12
fedify fedify 1.10.11
fedify fedify 2.0.19
fedify fedify 2.1.15
fedify fedify 2.2.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
CWE-1389 The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects the Fedify TypeScript library, which is used to build federated server applications powered by ActivityPub. The issue lies in the IPv4 validation logic used to prevent Server-Side Request Forgery (SSRF) attacks by validating public URLs before fetching documents or media.

Although the library blocks common private and local IPv4 ranges such as 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16, it incorrectly treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations.

Because the validation is incomplete, attackers can bypass the SSRF protections and potentially make requests to internal or otherwise restricted network addresses, which the library intended to block.

Impact Analysis

This vulnerability can allow an attacker to perform SSRF attacks by bypassing the public URL validation in Fedify. This means an attacker could potentially make unauthorized requests to internal network resources or other restricted IP ranges.

The impact includes unauthorized access to internal services, information disclosure, and possibly limited denial of service or integrity issues, as indicated by the CVSS score which rates confidentiality impact as high, integrity as low, and availability as low.

Mitigation Strategies

To mitigate this vulnerability, you should update Fedify to one of the patched versions: 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4. These versions contain an updated patch that improves the IPv4 validation logic to better reject non-public IPv4 destinations and prevent SSRF bypass.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50131. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart