Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Published: 2025-12-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rchf-xwx2-hm93 Fedify has ReDoS Vulnerability in HTML Parsing Regex
History

Tue, 17 Mar 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Fedify
Fedify fedify
CPEs cpe:2.3:a:fedify:fedify:*:*:*:*:*:*:*:*
Vendors & Products Fedify
Fedify fedify

Wed, 24 Dec 2025 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Fedify Project
Fedify Project fedify
Vendors & Products Fedify Project
Fedify Project fedify

Mon, 22 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 22 Dec 2025 21:45:00 +0000

Type Values Removed Values Added
Description Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Title Fedify has ReDoS Vulnerability in HTML Parsing Regex
Weaknesses CWE-1333
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Fedify Fedify
Fedify Project Fedify
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-12-22T21:54:45.635Z

Reserved: 2025-12-18T13:52:15.491Z

Link: CVE-2025-68475

cve-icon Vulnrichment

Updated: 2025-12-22T21:54:41.120Z

cve-icon NVD

Status : Analyzed

Published: 2025-12-22T22:16:09.143

Modified: 2026-03-17T19:39:32.477

Link: CVE-2025-68475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-24T11:53:26Z

Weaknesses