CVE-2026-42462: Fedify Linked Data Signature bypass via JSON-LD restructuring

CVE-2026-42462 · Severity: high · CVSS 7 · Published 2026-06-10

Fedify is a library used to build federated social media servers that communicate using the ActivityPub protocol. A security flaw allows attackers to manipulate the structure of signed messages (like posts or profile updates) without breaking their digital signatures. This could allow an attacker to impersonate users or alter the content of messages, potentially leading to the spread of misinformation or unauthorized account actions across the federated network.

Technologies: Fedify, @fedify/fedify (npm). Vendors: Fedify, npm.

Quick answers

Is CVE-2026-42462 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42462 being exploited in the wild.
How severe is CVE-2026-42462?
High severity, with a CVSS score of 7, published 10 June 2026.
Which products and versions are affected?
Fedify < 1.9.11, < 1.10.10, < 2.0.18, < 2.1.14, < 2.2.3, < 2.2.3; @fedify/fedify (npm) < 2.2.3, SEMVER:introduced=2.2.0,fixed=2.2.3.
Is there a fix for CVE-2026-42462?
Yes. @fedify/fedify (npm): upgrade to 2.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42462 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42462?
Check whether you run Fedify or @fedify/fedify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @fedify/fedify (npm): upgrade to 2.2.3 or later
    npm install @fedify/fedify@2.2.3

Technical details

A signature bypass vulnerability exists in Fedify due to improper handling of JSON-LD features such as @graph, @included, and @reverse. Because signatures are verified against the canonical RDF graph representation, an attacker can restructure the JSON-LD document to change how the library interprets the root activity while the underlying graph (and thus the signature) remains valid. For example, an attacker could move a nested object to the top level or use @included to hide properties from the implementation. Additionally, the library failed to compact documents against a local context after verification, allowing attackers to use aliases to replace arbitrary portions of a signed document. The issue is resolved by rejecting problematic JSON-LD keywords and ensuring proper compaction.

Affected products

  • fedify-dev fedify < 1.9.11, < 1.10.10, < 2.0.18, < 2.1.14, < 2.2.3

Identifiers

  • CVE-2026-42462
  • GHSA-9rfg-v8g9-9367

Timeline

  • 2026-05-20: patched: Version 2.2.3 released
  • 2026-05-20: advisory: GitHub Security Advisory published
  • 2026-06-10: disclosed: CVE-2026-42462 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.