CVE-2026-50131— Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Possible ATT&CK Techniques 1AI
T1041 · Exfiltration Over C2 ChannelAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| fedify-dev | fedify | >= 0.11.2, < 1.9.12 | affected |
>= 1.10.0, < 1.10.11 | affected | ||
>= 2.0.0, < 2.0.19 | affected | ||
>= 2.1.0, < 2.1.15 | affected | ||
>= 2.2.0, < 2.2.4 | affected | ||
| fedify-dev | vocab-runtime | < 2.0.19 | affected |
>= 2.1.0, < 2.1.15 | affected | ||
>= 2.2.0, < 2.2.4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50131
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Fedify 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fedify是Hong Minhee个人开发者的一个 TypeScript 库。用于构建由 ActivityPub 和其他标准支持的联邦服务器应用程序。 Fedify 1.9.12之前版本、1.10.11之前版本、2.0.19之前版本、2.1.15之前版本和2.2.4之前版本存在代码问题漏洞，该漏洞源于IPv4验证逻辑不完整，isValidPublicIPv4Address函数未阻止特殊用途、保留、多播、基准测试和运营商级NAT IPv4范围，导致SSRF绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| fedify-dev | fedify | >= 0.11.2, < 1.9.12 | - | |
| fedify-dev | vocab-runtime | < 2.0.19 | - |
II. Public POCs for CVE-2026-50131
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9452 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-50131
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-50131 (1)
IV. Related Vulnerabilities
Same product: fedify
- CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Re - CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded r - CVE-2025-68475
Fedify has ReDoS Vulnerability in HTML Parsing Regex - CVE-2025-54888
@fedify/fedify: Improper Authentication and Incorrect Author - CVE-2025-23221
Fedify has an Infinite loop and Blind SSRF found inside the
Same vendor: fedify-dev
- CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Re - CVE-2026-25808
Hollo DMs get leaked and can be seen on Webfinger Browser - CVE-2025-68475
Fedify has ReDoS Vulnerability in HTML Parsing Regex - CVE-2025-54888
@fedify/fedify: Improper Authentication and Incorrect Author - CVE-2025-53941
Hollo renders posts received with form elements and allows s
Same weakness: CWE-918
- CVE-2026-49345
Mercator CVE Configuration Vulnerable to Server-Side Request - CVE-2026-12726
Awx: automation-controller: awx: github webhook second-order - CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure v - CVE-2026-11989
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Requ - CVE-2026-4328
Advanced Import: One-Click Demo Import for WordPress <= 1.4.
V. Comments for CVE-2026-50131
No comments yet