CVE-2026-34148: Resource Exhaustion in @fedify/fedify Due to Unbounded Redirects

Background

The @fedify/fedify package is a library designed for handling ActivityPub requests, enabling decentralized social networking functionalities. It allows servers to verify remote keys and load documents from remote sources. However, it is vulnerable to a resource exhaustion issue caused by unbounded HTTP redirects during the document loading process, which can lead to denial of service.

Vulnerability Detail

The vulnerability arises from the way @fedify/fedify handles HTTP redirects in its document loader. It follows 3xx responses recursively without enforcing a maximum redirect count or detecting loops in visited URLs. An attacker can exploit this by controlling a remote ActivityPub key or actor URL, causing the server to make numerous outbound requests from a single inbound request. This can lead to significant resource consumption, potentially overwhelming the server and resulting in denial of service. The issue has been confirmed in versions 1.9.1 and 1.9.2, and it affects both generic and authenticated document loaders.

npm install @fedify/fedify@2.4.4

Workaround

As a temporary workaround, you can implement a redirect limit in your application logic when using the document loader. Here is an example of how to set a maximum redirect count:

const MAX_REDIRECTS = 5;
let redirectCount = 0;

async function safeLoader(url) {
  if (redirectCount >= MAX_REDIRECTS) {
    throw new Error('Maximum redirect limit reached');
  }
  redirectCount++;
  return await loader(url);
}

Conclusion

The vulnerability CVE-2026-34148 in the @fedify/fedify package poses a significant risk due to its potential for resource exhaustion through unbounded HTTP redirects. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of your application.

See every vulnerability recorded for @fedify/fedify →

FAQ