npm/@fedify/vocab-runtime CVE-2026-50131: high 8.6, EPSS 0.35%
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Action: Upgrade @fedify/vocab-runtime to 2.0.19 or later.
npm i @fedify/vocab-runtime@2.0.19npm i @fedify/vocab-runtime@2.1.15npm i @fedify/vocab-runtime@2.2.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.19 | - |
| 2.1.0 | 2.1.15 | - |
| 2.2.0 | 2.2.4 | - |
Fixed versions
| 2.0.19 | 2.1.15 | 2.2.4 |
Sources
- osv: GHSA-xw9q-2mv6-9fr8#npm/@fedify/vocab-runtime
- https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8
- https://nvd.nist.gov/vuln/detail/CVE-2026-50131
- https://github.com/fedify-dev/fedify
CVE-2026-50131 · published · modified · JSON