Fedify में रिडायरेक्ट अनुक्रम के कारण संसाधन की कमी से प्रभावित, दूरस्थ कुंजी/दस्तावेज़ समाधान के दौरान असीमित रिडायरेक्ट का अनुसरण किया जा रहा है

This vulnerability allows an attacker who controls a remote ActivityPub key or actor URL to induce a denial-of-service condition. By crafting a malicious URL with multiple redirects, the attacker can force the Fedify server to make numerous outbound requests in response to a single inbound request. This rapid sequence of requests can consume significant server resources, including CPU, memory, and network bandwidth, leading to performance degradation or complete service unavailability. The blast radius extends to any service relying on @fedify/fedify for ActivityPub verification, potentially impacting multiple users or downstream systems.

Applications and services built using the @fedify/fedify Node.js package for ActivityPub verification are at risk. This includes Mastodon instances, decentralized social media platforms, and any system integrating ActivityPub functionality. Specifically, deployments relying on older versions of @fedify/fedify are most vulnerable.

• nodejs / server:

  npm list @fedify/fedify

• nodejs / server:

  npm audit @fedify/fedify

• nodejs / server: Check application logs for excessive outbound HTTP requests originating from ActivityPub verification processes. Look for patterns indicating repeated requests to the same or similar URLs. • nodejs / server: Monitor CPU and memory usage on the server. A sudden spike in resource consumption during ActivityPub verification could indicate exploitation.

1. 2026-04-07Disclosure

   disclosure

1. आरक्षित2026-03-25
2. प्रकाशित2026-04-07
3. EPSS अद्यतन2026-04-14

The primary mitigation is to upgrade to version 1.9.6 or later of the @fedify/fedify package. This version includes fixes to prevent the uncontrolled recursive redirect behavior. If upgrading is not immediately feasible, consider implementing a redirect limiting mechanism within your application. This could involve setting a maximum redirect count or implementing a visited-URL loop detection strategy to prevent excessive outbound requests. Additionally, configure your web server or proxy to limit the number of outbound requests per connection to mitigate the impact of a potential exploit.