CVE-2025-68475 Fedify has ReDoS Vulnerability in HTML Parsing Regex
Attackers can cause denial of service in Fedify applications by sending malicious HTML responses that trigger catastrophic regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68475?
CVE-2025-68475 is a high-severity denial of service vulnerability in fedify-dev fedify, published on 22 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Weakness: CWE-1333
Which versions are affected by CVE-2025-68475?
8 open source packages ship an affected version, including @fedify/fedify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fedify/fedify npm | All versions | 1.6.13 |
@fedify/fedify npm | All versions | 1.6.13 |
@fedify/fedify npm | From 1.7.0 | 1.7.14 |
@fedify/fedify npm | From 1.7.0 | 1.7.14 |
@fedify/fedify npm | From 1.8.0 | 1.8.15 |
@fedify/fedify npm | From 1.8.0 | 1.8.15 |
2 more packages
@fedify/fedify npm | From 1.9.0 | 1.9.2 |
@fedify/fedify npm | From 1.9.0 | 1.9.2 |
Products include Fedify Fedify.
How do I fix CVE-2025-68475?
Upgrade @fedify/fedify to a fixed version for your release line: 1.6.13, 1.7.14, 1.8.15 or 1.9.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68475 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68475 exists.
Sources
Also known as GHSA-rchf-xwx2-hm93.