CVE-2026-34148

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service. This vulnerability is fixed in 1.9.6, 1.10.5, 2.0.8, and 2.1.1.

• CWE-400
• CWE-770

• https://github.com/fedify-dev/fedify/releases/tag/1.10.5Release Notes
• https://github.com/fedify-dev/fedify/releases/tag/1.9.6Release Notes
• https://github.com/fedify-dev/fedify/releases/tag/2.0.8Release Notes
• https://github.com/fedify-dev/fedify/releases/tag/2.1.1Release Notes
• https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgpExploit, Vendor Advisory
• https://github.com/fedify-dev/fedify/security/advisories/GHSA-gm9m-gwc4-hwgpExploit, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34122A stack-based buffer overflow vulnerability was identified i…6.5
• CVE-2026-34123On Tapo C520WS v2, restricted accounts (for example, hub use…7
• CVE-2026-34124A denial-of-service vulnerability was identified in TP-Link …6.5
• CVE-2026-34126TP-Link has identified a vulnerability in Tapo L535E v1.0 an…7.5
• CVE-2026-34127A stored cross-site scripting (XSS) vulnerability has been i…4.8
• CVE-2026-3413A flaw has been found in itsourcecode University Management …9.8
• CVE-2026-34149Coolify is an open-source and self-hostable tool for managin…3.3
• CVE-2026-3415The XML and schema validation functionalities within the Sch…8.7
• CVE-2026-34150Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-34152Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34153Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34154Discourse is an open-source discussion platform. In versions…5.3