CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Incomplete IPv4 validation in Fedify allows attackers to bypass SSRF protections and access internal network resources via special-use IP ranges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50131?
CVE-2026-50131 is a high-severity server-side request forgery vulnerability in fedify-dev fedify, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
Which versions are affected by CVE-2026-50131?
16 open source packages ship an affected version, including @fedify/fedify and @fedify/vocab-runtime.
| Package | Affected | Fixed in |
|---|---|---|
@fedify/fedify npm | From 0.11.2 | 1.9.12 |
@fedify/fedify npm | From 0.11.2 | 1.9.12 |
@fedify/fedify npm | From 1.10.0 | 1.10.11 |
@fedify/fedify npm | From 1.10.0 | 1.10.11 |
@fedify/fedify npm | From 2.0.0 | 2.0.19 |
@fedify/fedify npm | From 2.0.0 | 2.0.19 |
10 more packages
@fedify/fedify npm | From 2.1.0 | 2.1.15 |
@fedify/fedify npm | From 2.1.0 | 2.1.15 |
@fedify/fedify npm | From 2.2.0 | 2.2.4 |
@fedify/fedify npm | From 2.2.0 | 2.2.4 |
@fedify/vocab-runtime npm | All versions | 2.0.19 |
@fedify/vocab-runtime npm | All versions | 2.0.19 |
@fedify/vocab-runtime npm | From 2.1.0 | 2.1.15 |
@fedify/vocab-runtime npm | From 2.1.0 | 2.1.15 |
@fedify/vocab-runtime npm | From 2.2.0 | 2.2.4 |
@fedify/vocab-runtime npm | From 2.2.0 | 2.2.4 |
How do I fix CVE-2026-50131?
Upgrade @fedify/fedify to a fixed version for your release line: 1.9.12, 1.10.11, 2.0.19 or 2.1.15.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-50131 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50131 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xw9q-2mv6-9fr8.