Description
Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic appears incomplete.
The validatePublicUrl() protection relies on isValidPublicIPv4Address() to reject non-public IPv4 destinations.
Recommendation
Update the @fedify/vocab-runtime package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.2.0, < 2.2.4 >= 2.1.0, < 2.1.15 < 2.0.19** Patched version(s): **2.2.4 2.1.15 2.0.19**
References
Could your website be exposed too?
SmartScanner can check your website for Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 - CVE-2026-34526
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
You might also like:
See something that needs correcting? Let us knowUpdated July 14, 2026