CVE-2026-50131 Overview
CVE-2026-50131 is a Server-Side Request Forgery (SSRF) vulnerability in Fedify, a TypeScript library for building federated server applications powered by ActivityPub. The flaw stems from an incomplete IPv4 address validation routine in the library's SSRF defense layer. The validatePublicUrl() function relies on isValidPublicIPv4Address() to reject non-public destinations before outbound fetches, but the allowlist logic misses several reserved, multicast, benchmarking, and carrier-grade NAT ranges. Affected versions include 0.11.2 through versions prior to 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4. This issue represents an incomplete mitigation for the prior SSRF advisory tracked as GHSA-p9cg-vqcc-grcx.
Critical Impact
Remote attackers can bypass SSRF protections to reach internal services across reserved IPv4 ranges, enabling unauthorized access to internal HTTP endpoints and potential information disclosure.
Affected Products
- Fedify versions 0.11.2 through 1.9.11
- Fedify versions 1.10.0 through 1.10.10
- Fedify versions 2.0.0 through 2.0.18, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.3
Discovery Timeline
- 2026-06-10 - CVE-2026-50131 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-50131
Vulnerability Analysis
Fedify performs outbound document and media fetches as part of ActivityPub federation. To defend against SSRF [CWE-918], the library validates destination URLs through validatePublicUrl() before issuing outbound requests. This routine calls isValidPublicIPv4Address() to confirm that the resolved IPv4 address is publicly routable.
The validator correctly blocks the most common private and link-local ranges, including 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16. However, the implementation treats other special-use IPv4 ranges as public. Attackers can craft federation payloads referencing URLs in these uncovered ranges to coerce the server into fetching internal or restricted destinations.
Root Cause
The root cause is incomplete denylist coverage in isValidPublicIPv4Address(). The function omits checks for carrier-grade NAT (100.64.0.0/10), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), TEST-NET ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24), multicast (224.0.0.0/4), and reserved future-use space (240.0.0.0/4). Because these ranges may resolve to internal infrastructure in some deployments, accepting them as public destinations breaks the SSRF boundary.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction. An attacker submits ActivityPub activities or federation requests containing URLs whose hostnames resolve to an address in one of the uncovered ranges. Fedify's pre-fetch validation passes, and the server issues an outbound HTTP request to the attacker-chosen internal destination. Responses can be reflected back into ActivityPub processing logic depending on how the host application consumes the fetched documents.
No verified exploit code is publicly available. For technical specifics, refer to the GitHub Security Advisory GHSA-xw9q-2mv6-9fr8.
Detection Methods for CVE-2026-50131
Indicators of Compromise
- Outbound HTTP requests from Fedify processes to IPv4 addresses in 100.64.0.0/10, 198.18.0.0/15, or TEST-NET ranges
- ActivityPub inbox payloads referencing URLs that resolve to multicast (224.0.0.0/4) or reserved (240.0.0.0/4) addresses
- Unexpected DNS lookups for hostnames pointing to internal or special-use IPv4 space originating from federation workers
Detection Strategies
- Inspect application and proxy logs for outbound fetches initiated by Fedify whose destination falls outside globally routable unicast space
- Correlate ActivityPub activity ingestion events with subsequent outbound requests to identify attacker-supplied URL fetches
- Apply egress firewall logging with explicit allowlists for known federation peers and alert on deviations
Monitoring Recommendations
- Enable verbose logging of validatePublicUrl() decisions and resolved IPs prior to outbound fetches
- Forward egress traffic from federation hosts to a monitored proxy that enforces destination IP policy independently of the application
- Track Fedify version inventory across deployments and alert on hosts running versions earlier than the patched releases
How to Mitigate CVE-2026-50131
Immediate Actions Required
- Upgrade Fedify to version 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4 depending on your release branch
- Audit federation logs for outbound fetches to non-public IPv4 ranges since deployment of an affected version
- Restrict egress from Fedify hosts using network controls that block all reserved and special-use IPv4 destinations
Patch Information
The Fedify maintainers released fixes in versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4. The patches extend isValidPublicIPv4Address() to reject additional reserved, multicast, benchmarking, and carrier-grade NAT ranges. Patch details are published in the GitHub Security Advisory GHSA-xw9q-2mv6-9fr8.
Workarounds
- Deploy an egress proxy that enforces a strict allowlist of public IP ranges and blocks all RFC-reserved IPv4 space
- Place Fedify behind a network namespace or firewall policy that denies traffic to 100.64.0.0/10, 198.18.0.0/15, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, and 240.0.0.0/4
- Wrap outbound HTTP clients with an application-layer URL validator that re-resolves hostnames and checks results against a complete special-use IPv4 list
# Example: upgrade Fedify to a patched release
npm install @fedify/fedify@2.2.4
# or for the 2.1.x branch
npm install @fedify/fedify@2.1.15
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
