Executive brief
Fedify is a TypeScript library used to build ActivityPub-compatible federated servers. A vulnerability in its getNodeInfo() function allows attackers to make the server fetch arbitrary URLs—including internal services, cloud metadata, and private networks—and return the results to the caller. This could expose sensitive data like IAM credentials, API keys, and internal service responses.
Technical details
The getNodeInfo() function performs two unauthenticated HTTP requests without validation: it fetches /.well-known/nodeinfo from a user-supplied host, then reads links[].href from the JSON response and fetches that URL with globalThis.fetch(). Because the second URL comes directly from the attacker-controlled server response, there is no check for private/loopback addresses, schemes beyond Node's default, redirect limits, or loops. An attacker can redirect to RFC 1918 private addresses (10.x, 172.16.x, 192.168.x), link-local addresses (169.254.169.254 for cloud metadata), loopback (127.0.0.1), or data: URLs, causing Fedify to fetch internal resources and return their bodies verbatim. The fix validates all requests against a public-address check, similar to protections already in place for WebFinger and document loading.
Affected products
- Fedify Fedify 1.2.0 through 2.3.1 (fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2)
Timeline
- 2026-07-18: disclosed: GitHub Security Advisory GHSA-hqph-j65v-8cq5 published
- 2026-07-15: patched: Fixes released in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2