CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
INFO
Published Date :
June 10, 2026, 10:17 p.m.
Last Modified :
July 21, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Fedify to version 1.9.12 or later.
- Update Fedify to version 1.10.11 or later.
- Update Fedify to version 2.0.19 or later.
- Update Fedify to version 2.1.15 or later.
Public PoC/Exploit Available at Github
CVE-2026-50131 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-50131.
| URL | Resource |
|---|---|
| https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8 | |
| https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-50131 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-50131
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page
cve ghsa security-advisory vulnerability-research
None
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-50131 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-50131 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added Translation Title: Fedify de fedify-dev, Description: Fedify es una biblioteca TypeScript para construir aplicaciones de servidor federadas impulsadas por ActivityPub. Fedify abordó previamente el acceso SSRF/a la red interna en GHSA-p9cg-vqcc-grcx añadiendo validación de URL pública antes de la obtención de documentos y medios en tiempo de ejecución. Sin embargo, la lógica de validación de IPv4 presente a partir de la versión 0.11.2 y anterior a las versiones 1.9.12, 1.10.11, 2.0.19, 2.1.15 y 2.2.4 parece incompleta. La protección 'validatePublicUrl()' se basa en 'isValidPublicIPv4Address()' para rechazar destinos IPv4 no públicos. La función bloquea rangos privados y locales comunes como '10.0.0.0/8', '127.0.0.0/8', '169.254.0.0/16', '172.16.0.0/12' y '192.168.0.0/16', pero aún trata varios rangos IPv4 de uso especial, reservados, de multidifusión, de evaluación comparativa y de NAT de grado de operador como destinos públicos válidos. Debido a que esta validación se utiliza como defensa SSRF antes de las recuperaciones salientes, esto parece ser una mitigación incompleta o una clase de bypass para el problema SSRF anterior. Las versiones 1.9.12, 1.10.11, 2.0.19, 2.1.15 y 2.2.4 contienen un parche actualizado. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'fedify-dev', 'product': 'fedify', 'versions': [{'status': 'affected', 'version': '>= 0.11.2, < 1.9.12'}, {'status': 'affected', 'version': '>= 1.10.0, < 1.10.11'}, {'status': 'affected', 'version': '>= 2.0.0, < 2.0.19'}, {'status': 'affected', 'version': '>= 2.1.0, < 2.1.15'}, {'status': 'affected', 'version': '>= 2.2.0, < 2.2.4'}]}, {'vendor': 'fedify-dev', 'product': 'vocab-runtime', 'versions': [{'status': 'affected', 'version': '< 2.0.19'}, {'status': 'affected', 'version': '>= 2.1.0, < 2.1.15'}, {'status': 'affected', 'version': '>= 2.2.0, < 2.2.4'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-50131', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-11T14:15:27.570315Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 11, 2026
Action Type Old Value New Value Added Reference https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8 -
New CVE Received by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added Description Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Added CWE CWE-918 Added CWE CWE-1286 Added CWE CWE-1389 Added Reference https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8