{"action":"Upgrade @fedify/fedify to 1.9.12 or later.","affected":[{"fixed":"1.9.12","introduced":"0.11.2"},{"fixed":"1.10.11","introduced":"1.10.0"},{"fixed":"2.0.19","introduced":"2.0.0"},{"fixed":"2.1.15","introduced":"2.1.0"},{"fixed":"2.2.4","introduced":"2.2.0"}],"component":"@fedify/fedify","cve_ids":["CVE-2026-50131"],"ecosystem":"npm","epss":0.00351,"exploited":false,"fixed_versions":["1.9.12","1.10.11","2.0.19","2.1.15","2.2.4"],"ghsa_id":"GHSA-xw9q-2mv6-9fr8","id":"tcs_01M5KGK358N2C5SHETP1Y49CYV","modified_at":"2026-07-28T05:30:29.570452989Z","published_at":"2026-07-14T18:15:25Z","references":["https://osv.dev/vulnerability/GHSA-xw9q-2mv6-9fr8","https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8","https://nvd.nist.gov/vuln/detail/CVE-2026-50131","https://github.com/fedify-dev/fedify"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-xw9q-2mv6-9fr8","url":"https://osv.dev/vulnerability/GHSA-xw9q-2mv6-9fr8"}],"summary":"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges"}