CVE-2026-42462CWE-1289CWE-180CWE-347CWE-436
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
High · published June 10, 2026
What it is
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
The record
Technical detail
- CVSS v3.1
- 7.0 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00249 · 15.3th percentile
- Weaknesses
- CWE-1289 · Improper Validation of Unsafe Equivalence in Input; CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize; CWE-347 · Improper Verification of Cryptographic Signature; CWE-436 · Interpretation Conflict
- Published
- 2026-06-10T20:22Z
EPSS history
Timeline