CVE-2026-62857

Received Received - Intake

Server-Side Request Forgery in Fedify Library

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-62857

Affected Vendors & Products

Vendor	Product	Version / Range
fedify	fedify	From 1.2.0 (inc) to 1.9 (inc)
fedify	fedify	From 1.10 (inc) to 2.3 (inc)
fedify	fedify	1.9.13
fedify	fedify	1.10.12
fedify	fedify	2.0.22
fedify	fedify	2.1.18
fedify	fedify	2.2.7
fedify	fedify	2.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Fedify versions 1.2.0 through 2.3 have a flaw in getNodeInfo() where it follows attacker-controlled links without validating the URL scheme, redirects, or private addresses. This allows requests to internal services like loopback, cloud metadata, or private networks, potentially exposing sensitive data.

Detection Guidance

To detect this vulnerability, check if your Fedify version is between 1.2.0 and the affected maintenance lines (1.9, 1.10, 2.0, 2.1, 2.2, 2.3). Verify if getNodeInfo() processes untrusted links without proper validation. Inspect network logs for unexpected requests to loopback, link-local, or private addresses.

Impact Analysis

An attacker could exploit this to access internal services, steal sensitive data, or perform unauthorized actions on your network. This could lead to data breaches, service disruption, or further network compromise if internal services are exposed.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Fedify to a patched version (1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, or 2.3.2) to fix the issue in getNodeInfo().

Hi! I’m here to help you understand CVE-2026-62857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70