Is CVE-2026-62857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62857 being exploited in the wild.

How severe is CVE-2026-62857?

Informational severity, with a CVSS score of 7.5, published 6 August 2026.

Which products and versions are affected?

Fedify 1.2.0 through 2.3.1 (fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2).

Is there a fix for CVE-2026-62857?

A patch was published on 2026-07-15: Fixes released in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62857 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62857?

Check whether you run Fedify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62857: Fedify getNodeInfo() server-side request forgery

CVE-2026-62857 · Severity: info · CVSS 7.5 · Published 2026-08-06

Fedify is a TypeScript library used to build ActivityPub-compatible federated servers. A vulnerability in its getNodeInfo() function allows attackers to make the server fetch arbitrary URLs—including internal services, cloud metadata, and private networks—and return the results to the caller. This could expose sensitive data like IAM credentials, API keys, and internal service responses.

Technologies: Fedify. Vendors: Fedify.

Quick answers

Is CVE-2026-62857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62857 being exploited in the wild.
How severe is CVE-2026-62857?: Informational severity, with a CVSS score of 7.5, published 6 August 2026.
Which products and versions are affected?: Fedify 1.2.0 through 2.3.1 (fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2).
Is there a fix for CVE-2026-62857?: A patch was published on 2026-07-15: Fixes released in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62857 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62857?: Check whether you run Fedify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The getNodeInfo() function performs two unauthenticated HTTP requests without validation: it fetches /.well-known/nodeinfo from a user-supplied host, then reads links[].href from the JSON response and fetches that URL with globalThis.fetch(). Because the second URL comes directly from the attacker-controlled server response, there is no check for private/loopback addresses, schemes beyond Node's default, redirect limits, or loops. An attacker can redirect to RFC 1918 private addresses (10.x, 172.16.x, 192.168.x), link-local addresses (169.254.169.254 for cloud metadata), loopback (127.0.0.1), or data: URLs, causing Fedify to fetch internal resources and return their bodies verbatim. The fix validates all requests against a public-address check, similar to protections already in place for WebFinger and document loading.

Affected products

Fedify Fedify 1.2.0 through 2.3.1 (fixed in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2)

Timeline

2026-07-18: disclosed: GitHub Security Advisory GHSA-hqph-j65v-8cq5 published
2026-07-15: patched: Fixes released in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, 2.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.