High · published December 23, 2025
⚡ A sneaky regex is causing catastrophic backtracking in Fedify! This means your server could freeze up like a deer in headlights when faced with malicious HTML. 🔥 Think of it like a busy restaurant kitchen where a single dish, if ordered incorrectly, can back up the entire service—nobody gets their food served on time! That's what happens when Fedify's document loader encounters nested quantifiers in its regex. An attacker could send specially crafted HTML responses that make the server's processing grind to a halt, effectively leading to a Denial of Service for users. This could result in downtime, frustrated users, and a lot of potential lost business.
Think of it like a busy restaurant kitchen where a single dish, if ordered incorrectly, can back up the entire service—nobody gets their food served on time! That's what happens when Fedify's document loader encounters nested quantifiers in its regex. This vulnerability resides in Fedify's document loader, where the HTML parsing regex utilizes nested quantifiers, causing the engine to struggle with certain inputs, ultimately resulting in a denial of service due to catastrophic backtracking.
An attacker could send specially crafted HTML responses that make the server's processing grind to a halt, effectively leading to a Denial of Service for users. This could result in downtime, frustrated users, and a lot of potential lost business. To protect your applications, upgrade Fedify to at least version 1.6.13, 1.7.14, 1.8.15, or 1.9.2. Review your deployment and ensure these updates are applied as soon as possible to avoid any disruption. You've got this! With these updates, your server will be back up and running smoothly in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fedify/fedify | < 1.6.13 | 1.6.13 |
| fedify/fedify | ≥ 1.7.0, < 1.7.14 | 1.7.14 |
| fedify/fedify | ≥ 1.8.1, < 1.8.15 | 1.8.15 |
| fedify/fedify | ≥ 1.9.0, < 1.9.2 | 1.9.2 |