GHSA-9rfg-v8g9-9367
High · 7.0CVSS
7.0
EPSS
—
Published
May 26, 2026
CISA due date
—
The record
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fedify/fedify | 0 | 1.9.11 |
| npm | @fedify/fedify | 1.10.0 | 1.10.10 |
| npm | @fedify/fedify | 2.0.0 | 2.0.18 |
| npm | @fedify/fedify | 2.1.0 | 2.1.14 |
| npm | @fedify/fedify | 2.2.0 | 2.2.3 |
Related vulnerabilities
- CVE-2026-42462 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Same vulnerability
- GHSA-gm9m-gwc4-hwgp Fedify affected by resource exhaustion caused by unbounded redirect following during… Also affects @fedify/fedify
- CVE-2026-34148 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Also affects @fedify/fedify
- CVE-2025-68475 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Also affects @fedify/fedify
- GHSA-rchf-xwx2-hm93 Fedify has ReDoS Vulnerability in HTML Parsing Regex Also affects @fedify/fedify
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289