Executive brief
Fedify, a library used for building decentralized social media applications, is vulnerable to a denial-of-service attack. An attacker can provide a malicious link that forces the server into an infinite loop of web requests. This can exhaust the server's resources, leading to slow performance or a complete service outage for all users.
Technical details
The vulnerability exists in the remote document loader and authenticated document loader of @fedify/fedify. These components recursively follow HTTP 3xx redirects without enforcing a maximum redirect count or implementing loop detection. An attacker can trigger this by providing a malicious ActivityPub keyId or actor URL that points to a self-referential redirect loop. Because failed lookups are only cached locally for the duration of a single request, the attack can be repeatedly executed to exhaust CPU, connection slots, and outbound bandwidth. Patches are available in versions 1.9.6, 1.10.5, 2.0.8, and 2.1.1.
Affected products
- fedify-dev @fedify/fedify < 1.9.6, >= 1.10.0, < 1.10.5, >= 2.0.0, < 2.0.8, = 2.1.0
- fedify-dev @fedify/vocab-runtime < 2.0.8, = 2.1.0
Timeline
- 2026-04-04: disclosed: Initial publication by dahlia to fedify-dev/fedify
- 2026-04-06: advisory: NVD publication date
- 2026-04-07: advisory: GitHub Advisory Database publication date