CVE-2026-42462 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Attackers can bypass LD-Signature verification in Fedify by restructuring JSON-LD documents, allowing them to alter signed activities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42462?
CVE-2026-42462 is a high-severity vulnerability in fedify-dev fedify, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
Which versions are affected by CVE-2026-42462?
10 open source packages ship an affected version, including @fedify/fedify.
| Package | Affected | Fixed in |
|---|---|---|
@fedify/fedify npm | All versions | 1.9.11 |
@fedify/fedify npm | All versions | 1.9.11 |
@fedify/fedify npm | From 1.10.0 | 1.10.10 |
@fedify/fedify npm | From 1.10.0 | 1.10.10 |
@fedify/fedify npm | From 2.0.0 | 2.0.18 |
@fedify/fedify npm | From 2.0.0 | 2.0.18 |
4 more packages
@fedify/fedify npm | From 2.1.0 | 2.1.14 |
@fedify/fedify npm | From 2.1.0 | 2.1.14 |
@fedify/fedify npm | From 2.2.0 | 2.2.3 |
@fedify/fedify npm | From 2.2.0 | 2.2.3 |
How do I fix CVE-2026-42462?
Upgrade @fedify/fedify to a fixed version for your release line: 1.9.11, 1.10.10, 2.0.18 or 2.1.14.
Is CVE-2026-42462 being exploited?
There is no known exploitation of CVE-2026-42462 in the wild and no public exploit code.
Sources
Also known as GHSA-9rfg-v8g9-9367.