chaitanyagarware/cve-2026-50131Curated landing page for CVE-2026-50131 detailing an incomplete SSRF mitigation bypass in Fedify's validatePublicUrl() with CVSS 8.6, linking to authoritative advisory records and affected version ranges.
Fedify incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl() allowed special-use IPv4 ranges.
Primary advisory: GHSA-xw9q-2mv6-9fr8
Official CVE record: CVE-2026-50131
Researcher credit: @chaitanyagarware
| Field | Value |
|---|
| CVE | CVE-2026-50131 |
| GHSA | GHSA-xw9q-2mv6-9fr8 |
| Project | fedify-dev/fedify |
| Packages | @fedify/fedify, @fedify/vocab-runtime |
| Ecosystems | npm, JSR |
| Severity | High |
| CVSS | 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| Weaknesses | CWE-918, CWE-1286, CWE-1389 |
| Published | GitHub advisory: 2026-06-08; CVE.org: 2026-06-10 |
| NVD status | Present, Deferred as of 2026-07-09 |
| OSV status | Present |
Fedify previously added public URL validation to mitigate SSRF and internal-network access. The follow-up issue was that the IPv4 validation logic still treated multiple special-use, reserved, multicast, benchmarking, documentation, and carrier-grade NAT ranges as public destinations.
Because validatePublicUrl() was used before outbound ActivityPub document and media fetching, the incomplete IP classification could bypass the intended SSRF protection boundary.
| Product | Affected |
|---|---|
@fedify/fedify | >= 0.11.2, < 1.9.12; >= 1.10.0, < 1.10.11; >= 2.0.0, < 2.0.19; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.4 |
@fedify/vocab-runtime | < 2.0.19; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.4 |
| Product | Fixed |
|---|---|
@fedify/fedify | 1.9.12, 1.10.11, 2.0.19, 2.1.15, 2.2.4 |
@fedify/vocab-runtime | 2.0.19, 2.1.15, 2.2.4 |
| Source | Status | Link |
|---|---|---|
| GitHub repository advisory | Published | GHSA-xw9q-2mv6-9fr8 |
| CVE.org / CVE Services | Published | CVE-2026-50131 |
| NVD | Present, Deferred | NVD detail |
| OSV | Present | OSV record |
| CVEProject cvelistV5 | Present | cvelistV5 JSON |
| CISA Vulnrichment | Present | vulnrichment JSON |
fedify-dev/fedify changelog references GHSA-xw9q-2mv6-9fr8.fedify-dev/hollo and fedify-dev/botkit changelogs reference the same advisory because they consume Fedify packages.Patrowl/PatrowlHearsData mirrors CVE and SSVC data for this ID.sec-dojo-com/cve-poc has a public page for CVE-2026-50131.This repository is a public index and portfolio landing page. It intentionally summarizes the vulnerability and links to authoritative records instead of copying full proof-of-concept exploit scripts.