CVE-2026-104817: Misskey Federated Platform DoS Vulnerability

CVE-2026-104817 Overview

CVE-2026-104817 affects Misskey, an open source federated social media platform. The unauthenticated fetch-rss API endpoint lacks rate limiting and response-size restrictions, and performs synchronous XML parsing. Attackers can trigger unbounded outbound HTTP requests and synchronous parsing operations against vulnerable instances. The flaw exists in versions from 12.112.1 through releases prior to 2026.7.0. Exploitation exhausts instance resources, amplifies requests toward third-party servers, and enables probing of network-reachable services even when federation is disabled. The weakness is classified as [CWE-405] Asymmetric Resource Consumption (Amplification).

Critical Impact
Unauthenticated attackers can exhaust server resources, amplify traffic toward third-party targets, and probe internal network services through the vulnerable fetch-rss endpoint.

Affected Products

Misskey versions 12.112.1 through releases prior to 2026.7.0
Self-hosted Misskey instances exposing the fetch-rss API endpoint
Federated and non-federated Misskey deployments

Discovery Timeline

2026-10-13 - CVE-2026-104817 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104817

Vulnerability Analysis

The fetch-rss endpoint in packages/backend/src/server/api/endpoints/fetch-rss.ts accepts URLs without authentication and fetches remote RSS feeds on behalf of the caller. The endpoint applies no rate limiting, no cap on response body size, and no URL length validation. Parsing of returned XML happens synchronously, blocking the Node.js event loop while large or malformed payloads are processed.

An unauthenticated attacker can submit crafted requests referencing arbitrary URLs. The server performs outbound HTTP fetches and synchronous XML parsing for every request. Concurrent requests multiply resource consumption, degrading availability for legitimate users.

Root Cause

The root cause is missing resource controls on an unauthenticated API endpoint. Specifically, the endpoint lacked a maximum URL length check, a maximum response body size limit, and a cap on concurrent outbound fetches. Synchronous XML parsing compounded the issue by consuming event-loop time proportional to payload size.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends repeated POST requests to the fetch-rss endpoint with attacker-controlled target URLs. Each request forces the Misskey backend to issue outbound HTTP traffic and parse the response synchronously. Attackers can target third-party servers to amplify traffic, probe internal services reachable from the Misskey host, or exhaust CPU and memory on the instance itself.

typescript

// Patch: packages/backend/src/server/api/endpoints/fetch-rss.ts
 import { Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { HttpRequestService } from '@/core/HttpRequestService.js';
+import { ApiError } from '../error.js';
 
-const rssParser = new Parser();
+const MAX_URL_LENGTH = 8192;
+const MAX_RESPONSE_SIZE = 1024 * 1024;
+const MAX_CONCURRENT_REQUESTS = 32;
 
 export const meta = {
 	tags: ['meta'],

Source: Misskey security commit a12ee2e

The patch introduces explicit limits on URL length (8192 bytes), response size (1 MB), and concurrent outbound requests (32), and adds HTTP 429 responses for rate-limited callers.

Detection Methods for CVE-2026-104817

Indicators of Compromise

High volume of inbound requests to the /api/fetch-rss endpoint from a single IP or small set of IPs
Sustained outbound HTTP connections from the Misskey backend to uncommon or attacker-controlled hosts
Elevated CPU utilization and event-loop lag on Misskey backend processes without corresponding user activity
Outbound connection attempts from the Misskey host to RFC1918 or link-local addresses

Detection Strategies

Enable access logging on the reverse proxy fronting Misskey and alert on burst request rates to /api/fetch-rss
Correlate inbound fetch-rss requests with outbound network flows to identify amplification patterns
Monitor Node.js process metrics for event-loop lag and sustained CPU saturation
Review target URLs supplied to the endpoint for internal network ranges or unusually long strings

Monitoring Recommendations

Instrument the Misskey backend with request metrics tagged by endpoint and source IP
Alert on repeated HTTP 500 or timeout responses from /api/fetch-rss indicating resource exhaustion
Track egress bandwidth from the Misskey host and alert on anomalous spikes
Log all outbound HTTP requests originating from the backend process for post-incident analysis

How to Mitigate CVE-2026-104817

Immediate Actions Required

Upgrade all Misskey instances to version 2026.7.0 or later without delay
Restrict public access to the /api/fetch-rss endpoint via reverse-proxy ACLs until the patch is applied
Apply upstream rate limiting at the reverse proxy or WAF for the fetch-rss route
Review outbound network egress rules to prevent the Misskey host from reaching internal services

Patch Information

The vulnerability is fixed in Misskey 2026.7.0. The patch introduces MAX_URL_LENGTH, MAX_RESPONSE_SIZE, and MAX_CONCURRENT_REQUESTS constants and returns HTTP 429 for rate-limited requests. See the GitHub Security Advisory GHSA-4x7v-qx8f-g3p8 and the 2026.7.0 release notes for full details.

Workarounds

Block the /api/fetch-rss route at the reverse proxy for unauthenticated clients until patching
Enforce strict rate limiting (requests per second per source IP) at an upstream WAF
Place the Misskey backend in a network segment that cannot reach internal management interfaces
Monitor and cap outbound bandwidth from the Misskey host to limit amplification impact

bash

# Example nginx rate limit for /api/fetch-rss
limit_req_zone $binary_remote_addr zone=fetchrss:10m rate=5r/m;

location = /api/fetch-rss {
    limit_req zone=fetchrss burst=5 nodelay;
    limit_req_status 429;
    proxy_pass http://misskey_backend;
}