CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
Attacker-controlled URLs in Fedify's getNodeInfo() allow accessing internal network resources and reading their responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62857?
CVE-2026-62857 is a high-severity server-side request forgery vulnerability in fedify-dev fedify, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
Weakness: CWE-918
Which versions are affected by CVE-2026-62857?
How do I fix CVE-2026-62857?
No fix has been published for CVE-2026-62857 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-62857 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62857 exists.
Sources
Also known as GHSA-hqph-j65v-8cq5.