@fedify/fedify
npm4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @fedify/fedifypage 1 of 1
- CVE-2024-39687HIGHCVSS 7.2EG 7.2✓ Fixed in 0.11.22024-07-05
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the …
- CVE-2025-23221MEDIUMCVSS 5.4EG 5.4✓ Fixed in 1.3.42025-01-20
vulnerable: 1.3.3
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Hos…
- CVE-2025-54888NONECVSS 0.0EG 0.0✓ Fixed in 1.8.52025-08-09
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and …
- CVE-2026-34148HIGHCVSS 7.5EG 7.5✓ Fixed in 2.1.12026-04-06
vulnerable: 2.1.0
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document …
Check whether @fedify/fedify is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @fedify/fedify CVEs against the assets you own.
Start Free Scan →