# CVE-2026-50131: Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges > Incomplete IPv4 validation in Fedify allows attackers to bypass SSRF protections and access internal network resources via special-use IP ranges. - **Severity:** High 8.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 10 Jun 2026 - **Updated:** 11 Jun 2026 - **Also known as:** GHSA-xw9q-2mv6-9fr8 ## What is CVE-2026-50131? CVE-2026-50131 is a high-severity server-side request forgery vulnerability in fedify-dev fedify, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch. Weakness: CWE-918 (Server-Side Request Forgery), CWE-1389 (Incorrect Parsing of Numbers with Different Radices), CWE-1286 (Improper Validation of Syntactic Correctness of Input) ## Which versions are affected by CVE-2026-50131? 16 open source packages ship an affected version, including @fedify/fedify and @fedify/vocab-runtime. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `@fedify/fedify` | npm | From 0.11.2 | 1.9.12 | | `@fedify/fedify` | npm | From 0.11.2 | 1.9.12 | | `@fedify/fedify` | npm | From 1.10.0 | 1.10.11 | | `@fedify/fedify` | npm | From 1.10.0 | 1.10.11 | | `@fedify/fedify` | npm | From 2.0.0 | 2.0.19 | | `@fedify/fedify` | npm | From 2.0.0 | 2.0.19 | | `@fedify/fedify` | npm | From 2.1.0 | 2.1.15 | | `@fedify/fedify` | npm | From 2.1.0 | 2.1.15 | | `@fedify/fedify` | npm | From 2.2.0 | 2.2.4 | | `@fedify/fedify` | npm | From 2.2.0 | 2.2.4 | | `@fedify/vocab-runtime` | npm | All versions | 2.0.19 | | `@fedify/vocab-runtime` | npm | All versions | 2.0.19 | | `@fedify/vocab-runtime` | npm | From 2.1.0 | 2.1.15 | | `@fedify/vocab-runtime` | npm | From 2.1.0 | 2.1.15 | | `@fedify/vocab-runtime` | npm | From 2.2.0 | 2.2.4 | | `@fedify/vocab-runtime` | npm | From 2.2.0 | 2.2.4 | ## How do I fix CVE-2026-50131? Upgrade @fedify/fedify to a fixed version for your release line: 1.9.12, 1.10.11, 2.0.19 or 2.1.15. ## Is CVE-2026-50131 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50131 exists. Public exploit code: - CVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page (github_poc): https://github.com/chaitanyagarware/CVE-2026-50131 ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-50131 and fix it if it is affected. What it is: CVE-2026-50131 is a high-severity server-side request forgery vulnerability in fedify-dev fedify, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50131 exists. Affected packages and fixed versions: - @fedify/fedify (npm): affected from 0.11.2; fixed in 1.9.12 - @fedify/fedify (npm): affected from 0.11.2; fixed in 1.9.12 - @fedify/fedify (npm): affected from 1.10.0; fixed in 1.10.11 - @fedify/fedify (npm): affected from 1.10.0; fixed in 1.10.11 - @fedify/fedify (npm): affected from 2.0.0; fixed in 2.0.19 - @fedify/fedify (npm): affected from 2.0.0; fixed in 2.0.19 - @fedify/fedify (npm): affected from 2.1.0; fixed in 2.1.15 - @fedify/fedify (npm): affected from 2.1.0; fixed in 2.1.15 - @fedify/fedify (npm): affected from 2.2.0; fixed in 2.2.4 - @fedify/fedify (npm): affected from 2.2.0; fixed in 2.2.4 - @fedify/vocab-runtime (npm): affected all versions; fixed in 2.0.19 - @fedify/vocab-runtime (npm): affected all versions; fixed in 2.0.19 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-50131/ (Markdown: https://insights.sbomify.com/CVE-2026-50131/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-50131 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50131 - OSV: https://osv.dev/vulnerability/CVE-2026-50131 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-50131/ Summaries are generated and may contain mistakes; the official description above is the record.