CVE-2026-50131: Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Synopsis

An incomplete server-side request forgery (SSRF) mitigation exists in Fedify, a TypeScript library for building ActivityPub-based federated server applications. The `validatePublicUrl()` function, added to block outbound requests to internal addresses, fails to reject several special-use IPv4 ranges including multicast, benchmarking, carrier-grade NAT, and other reserved blocks, leaving those ranges reachable via crafted ActivityPub fetch requests over the network without any authentication. Successful exploitation allows an attacker to read data from internal services on those overlooked ranges, tamper with limited request targets, and degrade availability of backend services. HarborGuard is tracking this advisory for patch availability as no fixed version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable fetch logic is reachable over the network, so the attacker must be able to send HTTP requests to the Fedify-powered service from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the SSRF can be triggered through unauthenticated ActivityPub document or media fetch paths.

• Victim interactionNot required

  No user action is required; the attacker triggers the outbound fetch directly by supplying a crafted URL to the affected endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup beyond supplying a URL in one of the unblocked special-use IPv4 ranges.

Blast Radius

• An attacker reads responses from internal services bound to special-use IPv4 ranges (such as carrier-grade NAT, multicast, or benchmarking subnets) that the incomplete blocklist fails to reject, potentially exposing configuration data, tokens, or other sensitive content.
• An attacker issues requests that modify state on internal HTTP services reachable through those ranges, for example triggering administrative endpoints or writing data to unauthenticated internal APIs.
• An attacker causes repeated outbound connections to unresponsive or slow internal addresses, increasing latency and consuming connection-pool resources on the Fedify host, degrading service responsiveness.