Fedify-dev vulnerabilities

Products

• Fedify 5
• Hollo 2

Newest

• @fedify fedify Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources CVE-2026-62857 8.8 HighAugust 6, 2026
• @fedify fedify, vocab-runtime +1 more Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVE-2026-50131 Public exploitFix available 8.6 HighJune 10, 2026
• @fedify fedify Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVE-2026-42462 Fix available 7.0 HighMay 26, 2026
• fedify hollo Hollo DMs get leaked and can be seen on Webfinger Browser CVE-2026-25808 7.5 HighFebruary 9, 2026
• @fedify fedify Fedify has ReDoS Vulnerability in HTML Parsing Regex CVE-2025-68475 Fix available 7.5 HighDecember 22, 2025
• @fedify fedify @fedify/fedify: Improper Authentication and Incorrect Authorization CVE-2025-54888 Fix available 8.7 HighAugust 8, 2025
• fedify-dev hollo Hollo renders posts received with form elements and allows submission CVE-2025-53941 6.1 MediumJuly 17, 2025