← Feed

Posts

• View post

  Fedify security updates: 2.0.35, 2.1.31, 2.2.20, 2.3.15, and 2.4.5 If you use an affected Fedify release, update now. Two server-side request forgery vulnerabilities have been addressed: GHSA-r48c-xx2h-fv4g, a DNS rebinding bypass of Fedify's private address checks, and GHSA-cj5r-cw77-6gwp, unvalidated page and favicon requests in fedify nodeinfo. Deno deployments need additional network restrictions; upgrading Fedify alone does not close the DNS rebinding vulnerability. The patched relea...

• View post

  Fedify security updates: 2.0.34, 2.1.30, 2.2.19, 2.3.14, and 2.4.4 If you use an affected Fedify release, update now. Two vulnerabilities have been fixed in @fedify/fedify: GHSA-4qhx-hhwf-8685, an inbox origin validation flaw that could let an attacker supply forged objects or suppress genuine activities, and GHSA-8863-8468-7hq7, a flaw in the key ownership check that could authenticate activities as the wrong actor under specific actor-document configurations. The releases containing both fi...

• View post

  Fedify 2.4.0: FEP-ef61 portable objects, background tasks, media uploads, and inbox request reports 한국어 (Korean): Fedify 2.4.0: FEP-ef61 이식 가능한 객체, 백그라운드 작업, 미디어 업로드 및 인박스 요청 리포트 · 자동 번역 日本語 (Japanese): Fedify 2.4.0: FEP-ef61ポータブルオブジェクト、バックグラウンドタスク、メディアアップロード、およびインボックスリクエストレポート · 自動翻訳 Fedify is a TypeScript framework for building ActivityPub servers. It implements federation details such as HTTP Signatures, JSON-LD processing, WebFinger, inbox and outbox routing, and activity delivery. Fed...

• View post

  Fedify security updates: 2.0.30, 2.1.26, 2.2.15, 2.3.10, and 2.4.0 Two vulnerabilities have been fixed: GHSA-97w4-f4rq-mgqm, unbounded alternate-document fetch chains vulnerability and GHSA-39gj-rchc-q5m3, unverified activity routed after dereference verification vulnerability. The patched releases are 2.0.30, 2.1.26, 2.2.15, 2.3.10, and 2.4.0. Both vulnerabilities affect the preceding releases on those lines: 2.0.28 and 2.0.29, 2.1.24 and 2.1.25, 2.2.13 and 2.2.14, 2.3.8 and 2.3.9. If you st...

• View post

  If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing. Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-kn...

• View post

  한국어(대한민국) (Korean (South Korea)): ActivityPub 구현이 어려운 이유, 그리고 어렵지 않아도 되는 이유 日本語 (Japanese): ActivityPubの実装が難しい理由、そしてそれが難しくなくなる理由 A quiet failure Picture the moment your server sends its first Follow activity to Mastodon. You read the spec, built the JSON, signed the HTTP request, and POSTed it with care. What comes back is a single line: 401 Unauthorized. No body. No explanation. What went wrong? Maybe the clock behind your Date header drifted a few minutes. Maybe the hash in your Digest h...

• View post

  Welcome to Fedify's new official account! The previous account, @fedify@hollo.social, is no longer in use and has been replaced by this one.