Tessera
Folgen

Fedify: ActivityPub server framework

@fedify.hollo.social.ap.brid.gy

:fedify: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the […] 🌉 bridged from ⁂ https://hollo.social/@fedify, follow @ap.brid.gy to interact

132 Posts47 Follower0 Folgt
Fedify: ActivityPub server framework@fedify.hollo.social.ap.brid.gy · 3w ago

Fedify security updates: 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing. Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's `/.well-known/nodeinfo` document, then follows the NodeInfo document URL that response advertises. The vulnerable path is `getNodeInfo()`, along with the `Context.lookupNodeInfo()` method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a `data:` URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata. The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as `data:` are rejected outright. These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An `allowPrivateAddress` opt-out is coming in 2.4.0. Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. Update `@fedify/fedify`: npm update @fedify/fedify yarn upgrade @fedify/fedify pnpm update @fedify/fedify bun update @fedify/fedify deno update @fedify/fedify After updating, redeploy. If you run other Fedify-based servers, update those too. Thanks to @rvzsec and @manus-use for the report and responsible disclosure. If anything is unclear, ask below.

hackers.pub

洪 民憙 (Hong Minhee) :nonbinary:@hongminhee.hollo.social.ap.brid.gy · 3mo ago

日本で世界初のFedifyの書籍「実践Fedify——ActivityPubマイクロブログ開発入門」が出版されました。この本は私にとって初めての著書でもありますが、最初の本が母語の韓国語ではなく日本語だというのは、なんだかとても不思議な気分ですね。本書は、英語で書かれたFedifyの公式チュートリアル「Creating your own federated microblog」をベースに、様々な加筆を行ったものです。Fedifyのマスコットの恐竜と、Misskeyのマスコットである三須木みすき 藍あい、Mastodon […] [Original post on hollo.social]

インプレス NextPublishing刊、洪 民憙（ホン・ミンヒ）著「実践Fedify——ActivityPubマイクロブログ開発入門」の表紙。セーラー服を着たMisskeyの猫耳マスコット・藍ちゃんが、Fedifyの青い恐竜マスコットとMastodonの黄色い象マスコットの上でジャンプしながら指を差しており、周囲にはカラフルな星や幾何学模様が散りばめられている。
Julian Fietkau@fietkau.me · 5mo ago

@fedify That is one juicy changelog! 🤩 Makes me want to jump into upgrading @encyclia, especially after we postponed the Fresh 2.x integration. But it sounds like that's going to be a bit of an adventure, so I'll wait until I can set an afternoon aside for it.

Emelia@thisismissem.social · 5mo ago

The really cool thing about this new architecture is that it can enable Client to Server architecture for AP with fedify (maybe vocab packages could be used in the browser too!)