CVE-2026-62857: Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 1.9.13 - Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 1.10.12 - Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 2.0.22 - Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 2.2.7 - Upgrade
Upgrade
Fedifyto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62857?
CVE-2026-62857 has a risk rating of 71.
What vulnerability affects Fedify in CVE-2026-62857?
CVE-2026-62857 describes a Server-Side Request Forgery (SSRF) vulnerability in the getNodeInfo() function.
How do I fix CVE-2026-62857?
To fix CVE-2026-62857, upgrade to Fedify version 2.3.2 or later.
What versions of Fedify are affected by CVE-2026-62857?
Fedify versions from 1.2.0 to 2.3 are affected by CVE-2026-62857.
What can an attacker achieve through CVE-2026-62857?
An attacker can exploit CVE-2026-62857 to access internal network resources via the getNodeInfo() function.