CVE-2026-34148: Fedify Fedify/fedify

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

Affected products

• Fedify Fedify/fedify: before 1.9.6 (fixed in 1.9.6); from 1.10.0, before 1.10.5 (fixed in 1.10.5); from 2.0.0, before 2.0.8 (fixed in 2.0.8); from 2.1.0, before 2.1.1 (fixed in 2.1.1)
• Fedify Fedify/vocab-Runtime: before 2.0.8 (fixed in 2.0.8); from 2.1.0, before 2.1.1 (fixed in 2.1.1)

Published 2026-04-06. Last modified 2026-06-17.