SSRF Vulnerability in Fedify TypeScript Library by Fedify
CVE-2026-50131
Key Information:
- Vendor
Fedify-dev
- Status
- Vendor
- CVE Published:
- 10 June 2026
Badges
What is CVE-2026-50131?
The Fedify TypeScript library, used for building federated server applications powered by ActivityPub, has a critical vulnerability relating to Server-Side Request Forgery. While prior updates attempted to address internal network access by adding public URL validation for outbound fetches, the validation logic for IPv4 addresses was found to be incomplete. Specifically, certain reserved and special-use IPv4 ranges that should not be accessible were incorrectly deemed valid public destinations. This oversight can allow attackers to exploit SSRF weaknesses, potentially leading to unauthorized internal network access. Users are strongly encouraged to upgrade to the patched versions mentioned to mitigate this risk.
Affected Version(s)
fedify >= 0.11.2, < 1.9.12 < 0.11.2, 1.9.12
fedify >= 1.10.0, < 1.10.11 < 1.10.0, 1.10.11
fedify >= 2.0.0, < 2.0.19 < 2.0.0, 2.0.19
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.