CVE-2025-46553 Overview
CVE-2025-46553 is a logic error in @misskey-dev/summaly, a Node.js tool that generates summaries of web pages. The flaw affects versions starting at 3.0.1 and prior to 5.2.1. The main summaly function fails to forward the allowRedirects option to its plugins. As a result, the option is never enforced, and Misskey follows HTTP redirects even when callers explicitly request otherwise. The issue is classified under CWE-601: URL Redirection to Untrusted Site. Version 5.2.1 contains the patch.
Critical Impact
Applications relying on allowRedirects: false to constrain outbound requests will still follow redirects, potentially exposing the fetcher to untrusted destinations chosen by the target URL.
Affected Products
- @misskey-dev/summaly versions >= 3.0.1 and < 5.2.1
- Misskey server deployments consuming vulnerable summaly versions
- Node.js integrations using summaly's allowRedirects option
Discovery Timeline
- 2025-05-05 - CVE-2025-46553 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46553
Vulnerability Analysis
The summaly package acts as an HTTP fetcher and metadata extractor for URL previews. Callers can pass an allowRedirects option to prevent the library from following HTTP 3xx responses. The main dispatch function accepts this option but never propagates it to the plugin-level scraping functions in src/general.ts. Because the plugins default to following redirects, the caller's intent is silently ignored. This behavior undermines defenses that assume a URL preview stays on the originally requested host, such as server-side request forgery (SSRF) mitigations and safelist checks that only validate the initial URL.
Root Cause
The root cause is an option-passing omission in the summaly orchestration layer. The GeneralScrapingOptions type did not include a followRedirects field, and the call site in src/index.ts did not forward the caller-supplied value into the plugin options object. Downstream HTTP logic therefore ran with default redirect-following behavior.
Attack Vector
An attacker submits a URL to a Misskey instance or another summaly consumer. The submitted host responds with a redirect (HTTP 301/302/307/308) to a different destination chosen by the attacker. Because the redirect control is not enforced, summaly follows the chain and issues requests to the redirected target. User interaction is required, since summaly invocation is typically triggered by a user-initiated action such as posting a link.
// Patch: src/general.ts - add followRedirects to options type
export type GeneralScrapingOptions = {
lang?: string | null;
userAgent?: string;
+ followRedirects?: boolean;
responseTimeout?: number;
operationTimeout?: number;
contentLengthLimit?: number;
// Patch: src/index.ts - forward option to plugin invocation
lang: opts.lang,
userAgent: opts.userAgent,
responseTimeout: opts.responseTimeout,
+ followRedirects: opts.followRedirects,
operationTimeout: opts.operationTimeout,
contentLengthLimit: opts.contentLengthLimit,
contentLengthRequired: opts.contentLengthRequired,
Source: GitHub commit 45153b4
Detection Methods for CVE-2025-46553
Indicators of Compromise
- Outbound HTTP requests from Misskey or summaly hosts to domains that do not match the URL originally submitted by the user.
- Server logs showing chained 3xx responses immediately followed by requests to unrelated destinations.
- Unexpected requests from summaly's configured user agent to internal or metadata endpoints.
Detection Strategies
- Inspect the installed @misskey-dev/summaly version in package.json and lockfiles; flag any version between 3.0.1 and 5.2.1.
- Correlate submitted preview URLs with actual egress destinations at the proxy or firewall layer to detect divergence caused by redirects.
- Review Misskey audit logs for link-preview generation events tied to attacker-controlled short URLs or redirector services.
Monitoring Recommendations
- Log full HTTP redirect chains for outbound requests made by preview generators and alert on cross-origin transitions.
- Monitor DNS resolutions for summaly's process to detect lookups against internal ranges such as RFC1918 and cloud metadata addresses.
- Track dependency updates in CI to ensure @misskey-dev/summaly remains at or above the patched version.
How to Mitigate CVE-2025-46553
Immediate Actions Required
- Upgrade @misskey-dev/summaly to version 5.2.1 or later across all deployments and rebuild dependent images.
- For Misskey operators, deploy the Misskey release that pins the patched summaly version.
- Audit any custom plugins or forks to confirm they honor the followRedirects option after upgrade.
Patch Information
The fix is delivered in @misskey-dev/summaly5.2.1 via commit 45153b4. The patch adds followRedirects to GeneralScrapingOptions and forwards opts.followRedirects from the top-level summaly call into the plugin invocation. See the GitHub Security Advisory GHSA-7899-w6c4-vqc4 for maintainer guidance.
Workarounds
- Route summaly's outbound HTTP traffic through an egress proxy that blocks redirects to internal IP ranges and disallowed hosts.
- Constrain the summaly worker with network policies that deny access to cloud metadata endpoints and other sensitive internal services.
- Temporarily disable link-preview features for untrusted user input until the patched version is deployed.
# Upgrade summaly to the patched release
npm install @misskey-dev/summaly@5.2.1
# Verify the installed version
npm ls @misskey-dev/summaly
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
