CVE-2025-23221
1 advisory.
npm/@fedify/fedify CVE-2025-23221: medium 5.4, EPSS 0.59%
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Action: Upgrade @fedify/fedify to 1.0.14 or later.
npm i @fedify/fedify@1.0.14npm i @fedify/fedify@1.1.11npm i @fedify/fedify@1.2.11npm i @fedify/fedify@1.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.13 | 1.0.14 | - |
| 1.1.10 | 1.1.11 | - |
| 1.2.10 | 1.2.11 | - |
| 1.3.3 | 1.3.4 | - |
Fixed versions
| 1.0.14 | 1.1.11 | 1.2.11 | 1.3.4 |
Sources
- osv: GHSA-c59p-wq67-24wx
- https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx
- https://nvd.nist.gov/vuln/detail/CVE-2025-23221
- https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151
- https://github.com/dahlia/fedify/commit/c505eb82fcd6b5b17174c6659c29721bc801ab9a
- https://github.com/dahlia/fedify/commit/e921134dd5097586e4563ea80b9e8d1b5460a645
- https://github.com/dahlia/fedify
CVE-2025-23221 · published · modified · JSON