PT-2025-52723 · Fedify · Fedify

Yueyuel · Published 2025-12-22 · Updated 2025-12-26 · CVE-2025-68475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fedify versions prior to 1.6.13 Fedify versions prior to 1.7.14 Fedify versions prior to 1.8.15 Fedify versions prior to 1.9.2

Description Fedify is a TypeScript library used for building federated server applications based on ActivityPub. A Regular Expression Denial of Service (ReDoS) issue exists in the document loader component. The HTML parsing regular expression located at packages/fedify/src/runtime/docloader.ts:259 includes nested quantifiers that can lead to catastrophic backtracking when processing specially crafted HTML responses. This can cause a denial of service.

Recommendations Update to Fedify version 1.6.13 or later. Update to Fedify version 1.7.14 or later. Update to Fedify version 1.8.15 or later. Update to Fedify version 1.9.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-68475

GHSA-RCHF-XWX2-HM93

Affected Products

Fedify

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68475.json · Exploit
• https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779 · Patch
• https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93 · Vendor Advisory
• https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68475 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68475 · Vendor Advisory
• https://github.com/fedify-dev/fedify/releases/tag/1.8.15 · Note
• https://github.com/fedify-dev/fedify/releases/tag/1.9.2 · Note
• https://github.com/fedify-dev/fedify/releases/tag/1.6.13 · Note
• https://github.com/fedify-dev/fedify/releases/tag/1.7.14 · Note
• https://reddit.com/r/VulnMatter/comments/1pw544r/resumen_diario_de_vulnerabilidades_26122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pttxj6/resumen_diario_de_vulnerabilidades_23122025 · Reddit Post
• https://t.me/CVEtracker/40455 · Telegram Post
• https://twitter.com/CVEnew/status/2003233960537849929 · Twitter Post