THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-62857 — Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo withou

[NVD] CVE-2026-62857 — Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo withou

mednvdPublished 2026-08-06

CVE-2026-62857 CVSS: None Published: 2026-08-06T22:18:12.127

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowi

Indicators of compromise

CVE-2026-62857cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-62857