CVE-2026-42462
High · 7.0CVSS
7.0
EPSS
0.2%
Published
Jun 10, 2026
CISA due date
—
The record
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fedify/fedify | 0 | 1.9.11 |
| npm | @fedify/fedify | 1.10.0 | 1.10.10 |
| npm | @fedify/fedify | 2.0.0 | 2.0.18 |
| npm | @fedify/fedify | 2.1.0 | 2.1.14 |
| npm | @fedify/fedify | 2.2.0 | 2.2.3 |
Related vulnerabilities
- GHSA-9rfg-v8g9-9367 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring Same vulnerability
- GHSA-gm9m-gwc4-hwgp Fedify affected by resource exhaustion caused by unbounded redirect following during… Also affects @fedify/fedify
- CVE-2026-34148 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Also affects @fedify/fedify
- CVE-2025-68475 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Also affects @fedify/fedify
- GHSA-rchf-xwx2-hm93 Fedify has ReDoS Vulnerability in HTML Parsing Regex Also affects @fedify/fedify
- CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. CWE-180
- CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash… CWE-180
- CVE-2026-82481 The cohttp package before 6.3.0 for OCaml allows directory traversal. CWE-180