{"id":"EUVD-2026-36127","revision":null,"records":[{"revision":"8cfe973fa51e45c4bff581a5eaca6eb2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42462","aliases":[],"title":"Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring","description":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.","state":0,"publishedAt":"2026-06-10T20:22:35.383+00:00","modifiedAt":"2026-06-11T13:34:03.443+00:00","affected":[{"ecosystem":"Vendor product","name":"fedify","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fedify-dev\",\n                    \"product\": \"fedify\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.2.0, < 2.2.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.1.0, < 2.1.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, < 2.0.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.10.0, < 1.10.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 1.9.11\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","score":7,"severity":"HIGH"}],"references":["https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367","https://github.com/fedify-dev/fedify/releases/tag/2.2.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42462","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42462","identifiers":["CVE-2026-42462"]},"retained":false,"historicalAffected":[]},{"revision":"aa3a67439bf34bfeaf5726b983953912","observedAt":"2026-11-13T12:03:41.725+00:00","statement":{"source":"euvd","id":"EUVD-2026-36127","aliases":["CVE-2026-42462","GHSA-9rfg-v8g9-9367"],"title":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that woul…","description":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","score":7,"severity":null}],"references":["https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367","https://github.com/fedify-dev/fedify/releases/tag/2.2.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36127","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 10, 2026, 8:22:35 PM","dateUpdated":"Jun 11, 2026, 1:34:03 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36127","identifiers":["EUVD-2026-36127","CVE-2026-42462","GHSA-9rfg-v8g9-9367"]},"retained":false,"historicalAffected":[]},{"revision":"36efc4342ee64cd78db721ed8ab2e264","observedAt":"2026-10-25T10:17:15.856+00:00","statement":{"source":"nvd","id":"CVE-2026-42462","aliases":[],"title":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that woul…","description":"Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.","state":0,"publishedAt":"2026-06-10T22:16:57.387+00:00","modifiedAt":"2026-07-23T09:10:00.113+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","score":7,"severity":"HIGH"}],"references":["https://github.com/fedify-dev/fedify/releases/tag/2.2.3","https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42462","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-180","CWE-347","CWE-436","CWE-1289"],"productCriteria":[],"sourceDates":{"published":"2026-06-10T22:16:57.387","lastModified":"2026-07-23T09:10:00.113"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42462","identifiers":["CVE-2026-42462"]},"retained":false,"historicalAffected":[]},{"revision":"4d9626e35ba0427caf349a536cfe5bf9","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9rfg-v8g9-9367","aliases":["CVE-2026-42462"],"title":"Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring","description":"As told on Discord earlier, multiple projects are affected, and we would like to coordinate. For now, we are aiming at a May 6th release date, but this is not set in stone yet.\n\n### Summary\n\nAn attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received.\n\n### Details\n\nThe vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and JSON-LD offering many ways to represent the same graph.\n\nOne of the issues is that by taking a signed `Activity` with an embedded `object`, an attacker can move the top-level `Activity` to a `@graph` property and move the activity's `object` to the top-level. Such a transformation preserves the signature and changes how the payload is interpreted by pretty much all ActivityPub implementations, making them process the object and ignore the formely-top-level activity. This can be used when the graph contains an embedded activity. In Mastodon, that is the case of `{ \"type\": \"Undo\", \"object\": { \"type\": \"Announce\" } }`, but other implementations may sign other activities that can be exploited in the same way.\n\nThe `@reverse` keyword can also be used to change the shape of a JSON-LD document without changing the underlying graph, and could be used in a similar way to reverse an `Activity` and its `object`.\n\nAnother problematic feature is `@included`, which can be used to “move” properties outside of the normal tree, effectively making them invisible to most ActivityPub implementations, while, again, preserving the signature. This allows removing statuses or actor properties once a signed `Create` or `Update` activity is received.\n\nGiven that we have seen no use of `@graph`, `@included` or `@reverse` in ActivityPub payloads and that they are very complex to handle correctly (the only JSON-LD API functions that “normalize” `@included` and `@reverse` are flattening and framing, which both lose the root node), we have decided to reject them, and recommend you do so as well.\n\nDetection of `@graph`, `@included` and `@reverse` should happen after compacting the incoming activity to your context, as aliases can be used for those keywords.\n\nAdditionally, after a quick scan of Fedify's source code, I could not verify that JSON-LD documents with a verified Linked Data Signature were compacted against your local JSON-LD context. Not doing that allows an attacker to rename aliases to non-standard names and use non-mapped aliases to replace existing values, while still leaving the signature intact. This allows an attacker to essentially replace arbitrary portions of any signed JSON-LD document and completely forge any activity while still passing verification. A similar issue was fixed in Mastodon a few years ago: https://github.com/mastodon/mastodon/pull/17426.\n\n### Impact\n\nThe impact is difficult to assess as this depends on the types of activities that are actually signed and processed in the wild.\n\nThe `@included` keyword allows “removing” arbitrary attributes, thus allowing replaying `Create` and `Update` activities while stripping away any attribute, such as content or metadata, which can lead to integrity and availability issues, although confidentiality issues are unlikely.\n\nThe `@graph` and `@reverse` keywords allow changing the root activity, which in the case of Mastodon allows sending an `Announce` from a `Undo { Announce }`, but might have wider consequences depending on what various servers sign.\n\nThe lack of compacting can allow rewriting any activity arbitrarily, thus leading to major integrity, availability, and possibly confidentiality issues (e.g. by replacing an actor's `inbox`).","state":0,"publishedAt":"2026-05-26T23:38:37+00:00","modifiedAt":"2026-09-10T03:50:46.5615349+00:00","affected":[{"ecosystem":"npm","name":"@fedify/fedify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.2.0"},{"kind":"fixed","version":"2.2.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@fedify/fedify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.0"},{"kind":"fixed","version":"2.1.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@fedify/fedify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.0.18"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@fedify/fedify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.10.0"},{"kind":"fixed","version":"1.10.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@fedify/fedify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367","https://nvd.nist.gov/vuln/detail/CVE-2026-42462","https://github.com/fedify-dev/fedify","https://github.com/fedify-dev/fedify/releases/tag/2.2.3"],"sourceUrl":"https://github.com/advisories/GHSA-9rfg-v8g9-9367","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9rfg-v8g9-9367","identifiers":["GHSA-9rfg-v8g9-9367","CVE-2026-42462"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}