This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-42462 | BDVDB-2026-339481 Detail

fedify-devfedify

Description#

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact low. Attack vector: network.

Weaknesses#

  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-347 Improper Verification of Cryptographic Signature
  • CWE-436 Interpretation Conflict
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.