fedify-dev vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 20264

Newest CVEs

• CVE-2026-62857

  Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

  fedify-dev · fedify

  High8.8
• CVE-2026-50131

  Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

  fedify-dev · fedify

  High8.6
• CVE-2026-42462

  Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

  fedify-dev · fedify

  High7.0
• CVE-2026-25808

  Hollo DMs get leaked and can be seen on Webfinger Browser

  fedify-dev · hollo

  High7.5
• CVE-2025-68475

  Fedify has ReDoS Vulnerability in HTML Parsing Regex

  fedify-dev · fedify

  High7.5
• CVE-2025-54888

  @fedify/fedify: Improper Authentication and Incorrect Authorization

  fedify-dev · fedify

  High8.7
• CVE-2025-53941

  Hollo renders posts received with form elements and allows submission

  fedify-dev · hollo

  Medium6.1