Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
fedify-dev fedify
>= 1.2.0, < 1.9.13affected>= 1.10.0, < 1.10.12affected>= 2.0.0, < 2.0.22affected>= 2.1.0, < 2.1.18affected>= 2.2.0, < 2.2.7affected>= 2.3.0, < 2.3.2affected