CVE-2025-68475
High
Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
SeverityHigh
CVSS7.5
Exploit probability—
ProductFedify
PublishedDec 22, 2025
First seenDec 22, 2025
Weakness typeCWE-1333CWE-1333
How to fix
Update
- fedify fedify1.6.13, 1.7.14, 1.8.15, 1.9.2 or later
- @fedify/fedify1.6.13, 1.7.14, 1.8.15, 1.9.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedify fedify | v < 1.6.13, 1.7.0 ≤ v < 1.7.14, 1.8.1 ≤ v < 1.8.15, 1.9.0 ≤ v < 1.9.2 | 1.6.13, 1.7.14, 1.8.15, 1.9.2 |
| @fedify/fedifynpm | v < 1.6.13, 1.7.0 ≤ v < 1.7.14, 1.8.0 ≤ v < 1.8.15, 1.9.0 ≤ v < 1.9.2 | 1.6.13, 1.7.14, 1.8.15, 1.9.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.