CVE-2025-23221

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4.

• CWE-835
• CWE-918

• https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151
• https://github.com/dahlia/fedify/commit/c505eb82fcd6b5b17174c6659c29721bc801ab9a
• https://github.com/dahlia/fedify/commit/e921134dd5097586e4563ea80b9e8d1b5460a645
• https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx

Published

Jan 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23216Argo CD is a declarative, GitOps continuous delivery tool fo…6.8
• CVE-2025-23217mitmproxy is a interactive TLS-capable intercepting HTTP pro…8.2
• CVE-2025-23218WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-23219WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-2322A vulnerability was found in 274056675 springboot-openai-cha…9.8
• CVE-2025-23220WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-23222An issue was discovered in Deepin dde-api-proxy through 1.0.…8.4
• CVE-2025-23225IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an a…6.5
• CVE-2025-23227IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 …5.4
• CVE-2025-2323A vulnerability was found in 274056675 springboot-openai-cha…5.3
• CVE-2025-23233Incorrect execution-assigned permissions for some Edge Orche…5.1
• CVE-2025-23234in OpenHarmony v5.0.2 and prior versions allow a local attac…5.5