fedify has 2 CVEs on record between 2025 and 2026. The median CVSS is 8.1 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Weakness classes
Products
- @fedify/fedify 1
- fedify 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
fedify vulnerabilities
CVEs affecting fedify, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-50131High· 8.6PoCFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
▾ Midnightfedify · @fedify/fedifyEPSS 0.35%via GHSA
CVE-2025-68475High· 7.5Fedify is a TypeScript library for building federated server apps powered by ActivityPub
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loade…
▾ Twilightfedify · fedifyEPSS 0.56%via NVD