CVE-2026-25540

The record

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.

Affected packages

Related vulnerabilities

• CVE-2026-23964 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23962 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23963 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23961 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2025-67500 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration Also affects mastodon
• CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
• CVE-2026-105752 vLLM is an inference and serving engine for large language models. CWE-524
• CVE-2026-94543 Next.js is a React framework for building full-stack web applications. CWE-524