CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Synopsis

This is a cryptographic signature bypass affecting Fedify, a TypeScript library for building ActivityPub-powered federated server applications. An attacker who has received a signed ActivityPub activity can exploit JSON-LD named-graph restructuring to alter the document's semantic meaning without invalidating its Linked Data Signature, allowing tampered activities to pass signature verification. Successful exploitation enables an attacker to forge or modify federated activities (such as posts, follows, or deletes) that appear to carry a legitimate third-party signature, enabling content tampering and limited information manipulation. No fix versions are currently published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Fedify-powered service over the network to deliver or relay a manipulated ActivityPub activity.

• AuthenticationNot required

  No account or credential is needed; the attack targets the signature-verification layer of the ActivityPub federation protocol, which accepts unsigned or externally signed input from any network peer.

• Victim interactionNot required

  No user action is required; the vulnerable parsing and verification logic executes automatically when the server processes an incoming federated activity.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must understand JSON-LD named-graph semantics well enough to craft a restructured document that changes Fedify's interpretation while preserving the original signature digest.

Blast Radius

• The attacker causes Fedify to accept and process a federated activity whose semantic content differs from what the original signer authorized, enabling unauthorized content modification across federated instances.
• Integrity of federated objects (posts, follow relationships, delete requests) is compromised because the verified signature no longer corresponds to the data Fedify actually acts on.
• Limited information disclosure is possible if the restructured activity causes the server to surface or relay data in an unintended context.
• Availability is marginally impacted, consistent with the CVSS A:L rating, for example through processing errors or state corruption triggered by malformed restructured activities.