{"id":"EUVD-2026-19295","enisaUuid":"3e7618d0-4e43-3cd3-a120-86831ff13f5e","description":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.","datePublished":"Apr 6, 2026, 3:06:53 PM","dateUpdated":"Apr 7, 2026, 2:25:51 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp\nhttps://github.com/fedify-dev/fedify/releases/tag/1.10.5\nhttps://github.com/fedify-dev/fedify/releases/tag/1.9.6\nhttps://github.com/fedify-dev/fedify/releases/tag/2.0.8\nhttps://github.com/fedify-dev/fedify/releases/tag/2.1.1\n","aliases":"CVE-2026-34148\nGHSA-gm9m-gwc4-hwgp\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"044d9f60-c772-3994-ad88-354bf73c237e","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"1.10.0, \u003c 1.10.5"},{"id":"11c7ac9e-45f6-3d67-a782-309983667094","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"\u003c 1.9.6"},{"id":"4794375c-57e8-3cef-bacc-b9e4b58b5c4b","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"2.0.0, \u003c 2.0.8"},{"id":"7af1e9cc-7d4e-35cc-a4c3-c4e9cac8654e","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"2.1.0, \u003c 2.1.1"},{"id":"7b994f3d-6a62-34b2-8a39-e4a533c9210a","product":{"name":"vocab-runtime","vendor":{"name":"@fedify"}},"product_version":"\u003c 2.0.8"},{"id":"f4dbfab5-866f-38e0-84cc-f3c40735bdfd","product":{"name":"vocab-runtime","vendor":{"name":"@fedify"}},"product_version":"2.1.0, \u003c 2.1.1"}],"enisaIdVendor":[{"id":"7392df9c-e12d-3dbc-93f6-a5323ea5c42b","vendor":{"name":"@fedify"}}],"enisaIdVulnerability":[{"id":"268ecb0d-c8ba-3406-9694-23efe93843cf","vulnerability":{"id":"CVE-2026-34148","description":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.","datePublished":"Apr 6, 2026, 3:06:53 PM","dateUpdated":"Apr 7, 2026, 2:25:51 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp\nhttps://github.com/fedify-dev/fedify/releases/tag/1.10.5\nhttps://github.com/fedify-dev/fedify/releases/tag/1.9.6\nhttps://github.com/fedify-dev/fedify/releases/tag/2.0.8\nhttps://github.com/fedify-dev/fedify/releases/tag/2.1.1\n","enisa_id":"EUVD-2026-19295\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"4911eeac-de3a-395c-bd7b-1fcb875f2509","product":{"name":"vocab-runtime","vendor":{"name":"@fedify"}},"product_version":"\u003c 2.0.8"},{"id":"bf24255a-9929-3220-acae-fd9606cde1ea","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"\u003c 1.9.6"},{"id":"c426f971-ca3a-3906-9e22-bffc02194a27","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"2.1.0, \u003c 2.1.1"},{"id":"d30ab3e9-accc-3078-bb6a-76ba2c0ef7c1","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"1.10.0, \u003c 1.10.5"},{"id":"d7bad072-3cd7-3d7a-bcc6-55024038fc2c","product":{"name":"vocab-runtime","vendor":{"name":"@fedify"}},"product_version":"2.1.0, \u003c 2.1.1"},{"id":"d7f8bcfb-ba75-3934-9c92-9a06435e70ca","product":{"name":"fedify","vendor":{"name":"@fedify"}},"product_version":"2.0.0, \u003c 2.0.8"}],"vulnerabilityVendor":[{"id":"a03206ed-566d-3c73-ac6e-bf874eb3e624","vendor":{"name":"@fedify"}}]}},{"id":"6d7b0ca6-a0fb-30b4-aa6b-8bd85c1f3dbb","vulnerability":{"id":"GHSA-gm9m-gwc4-hwgp","description":"Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution","datePublished":"Apr 7, 2026, 6:04:09 PM","dateUpdated":"Jun 9, 2026, 11:00:52 AM","baseScore":0.0,"references":"https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34148\nhttps://github.com/fedify-dev/fedify\nhttps://github.com/fedify-dev/fedify/releases/tag/1.10.5\nhttps://github.com/fedify-dev/fedify/releases/tag/1.9.6\nhttps://github.com/fedify-dev/fedify/releases/tag/2.0.8\nhttps://github.com/fedify-dev/fedify/releases/tag/2.1.1\n","enisa_id":"EUVD-2026-19295\n","aliases":"GHSA-gm9m-gwc4-hwgp\nCVE-2026-34148\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}