# CVE-2026-42462: Fedify Linked Data Signature bypass via JSON-LD restructuring

Source: https://junglewise.ai/threats/cve-2026-42462-fedify-linked-data-signature-bypass-via-json-ld-restructuring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-42462 · Severity: high · CVSS 7 · Published 2026-06-10

Fedify is a library used to build federated social media servers that communicate using the ActivityPub protocol. A security flaw allows attackers to manipulate the structure of signed messages (like posts or profile updates) without breaking their digital signatures. This could allow an attacker to impersonate users or alter the content of messages, potentially leading to the spread of misinformation or unauthorized account actions across the federated network.

Technologies: [Fedify](https://junglewise.ai/threats/technologies/fedify), [@fedify/fedify (npm)](https://junglewise.ai/threats/technologies/fedify-fedify). Vendors: [Fedify](https://junglewise.ai/threats/vendors/fedify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-42462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42462 being exploited in the wild.

**How severe is CVE-2026-42462?** High severity, with a CVSS score of 7, published 10 June 2026.

**Which products and versions are affected?** Fedify < 1.9.11, < 1.10.10, < 2.0.18, < 2.1.14, < 2.2.3, < 2.2.3; @fedify/fedify (npm) < 2.2.3, SEMVER:introduced=2.2.0,fixed=2.2.3.

**Is there a fix for CVE-2026-42462?** Yes. @fedify/fedify (npm): upgrade to 2.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42462 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42462?** Check whether you run Fedify or @fedify/fedify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @fedify/fedify (npm): upgrade to 2.2.3 or later

  ```sh
  npm install @fedify/fedify@2.2.3
  ```


## Technical details

A signature bypass vulnerability exists in Fedify due to improper handling of JSON-LD features such as @graph, @included, and @reverse. Because signatures are verified against the canonical RDF graph representation, an attacker can restructure the JSON-LD document to change how the library interprets the root activity while the underlying graph (and thus the signature) remains valid. For example, an attacker could move a nested object to the top level or use @included to hide properties from the implementation. Additionally, the library failed to compact documents against a local context after verification, allowing attackers to use aliases to replace arbitrary portions of a signed document. The issue is resolved by rejecting problematic JSON-LD keywords and ensuring proper compaction.

## Affected products

- fedify-dev fedify < 1.9.11, < 1.10.10, < 2.0.18, < 2.1.14, < 2.2.3

## Identifiers

- CVE-2026-42462
- GHSA-9rfg-v8g9-9367

## Timeline

- 2026-05-20: patched: Version 2.2.3 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-42462 published to NVD

## References

- [https://github.com/fedify-dev/fedify/releases/tag/2.2.3](https://github.com/fedify-dev/fedify/releases/tag/2.2.3)
- [https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367](https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367)

## Related threats

- [Fedify getNodeInfo() server-side request forgery](https://junglewise.ai/threats/cve-2026-62857-fedify-getnodeinfo-server-side-request-forgery)
- [Fedify SSRF via incomplete IPv4 validation in validatePublicUrl](https://junglewise.ai/threats/cve-2026-50131-fedify-ssrf-via-incomplete-ipv4-validation-in-validatepublicurl)
- [Fedify unbounded redirect following resource exhaustion in document loader](https://junglewise.ai/threats/cve-2026-34148-fedify-unbounded-redirect-following-resource-exhaustion-in)
- [Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.](https://junglewise.ai/threats/cve-2025-68475-fedify-redos-vulnerability-in-html-parsing-regex)
- [Fedify authentication bypass in ActivityPub inbox handler](https://junglewise.ai/threats/cve-2025-54888-fedify-authentication-bypass-in-activitypub-inbox-handler)