Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

Scores

EPSS (exploitation in 30 days)

0.42% · top 63% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-918: Server-Side Request Forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs

Affected products

• fedify-dev · fedify

  • affected >= 1.2.0, < 1.9.13
  • affected >= 1.10.0, < 1.10.12
  • affected >= 2.0.0, < 2.0.22
  • affected >= 2.1.0, < 2.1.18
  • affected >= 2.2.0, < 2.2.7
  • affected >= 2.3.0, < 2.3.2

References (2)

• https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/fedify-dev/fedify/releases/tag/2.3.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-62857](https://trackcve.app/badge/CVE-2026-62857.svg)](https://trackcve.app/cve/CVE-2026-62857)

Record last updated 8 Aug 2026, 02:40 UTC.