Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2025-68475
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-22 Dec, 2025 | 22:16
Updated At-17 Mar, 2026 | 19:39

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE Matches
fedify
fedify
>>fedify>>Versions before 1.6.13(exclusive)
cpe:2.3:a:fedify:fedify:*:*:*:*:*:*:*:*
fedify
fedify
>>fedify>>Versions from 1.7.0(inclusive) to 1.7.14(exclusive)
cpe:2.3:a:fedify:fedify:*:*:*:*:*:*:*:*
fedify
fedify
>>fedify>>Versions from 1.8.1(inclusive) to 1.8.15(exclusive)
cpe:2.3:a:fedify:fedify:*:*:*:*:*:*:*:*
fedify
fedify
>>fedify>>Versions from 1.9.0(inclusive) to 1.9.2(exclusive)
cpe:2.3:a:fedify:fedify:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-1333Primarysecurity-advisories@github.com
CWE ID: CWE-1333
Type: Primary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779security-advisories@github.com
Patch
https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987asecurity-advisories@github.com
Patch
https://github.com/fedify-dev/fedify/releases/tag/1.6.13security-advisories@github.com
Product
Release Notes
https://github.com/fedify-dev/fedify/releases/tag/1.7.14security-advisories@github.com
Product
Release Notes
https://github.com/fedify-dev/fedify/releases/tag/1.8.15security-advisories@github.com
Product
Release Notes
https://github.com/fedify-dev/fedify/releases/tag/1.9.2security-advisories@github.com
Product
Release Notes
https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93security-advisories@github.com
Exploit
Mitigation
Vendor Advisory
Hyperlink: https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/fedify-dev/fedify/releases/tag/1.6.13
Source: security-advisories@github.com
Resource:
Product
Release Notes
Hyperlink: https://github.com/fedify-dev/fedify/releases/tag/1.7.14
Source: security-advisories@github.com
Resource:
Product
Release Notes
Hyperlink: https://github.com/fedify-dev/fedify/releases/tag/1.8.15
Source: security-advisories@github.com
Resource:
Product
Release Notes
Hyperlink: https://github.com/fedify-dev/fedify/releases/tag/1.9.2
Source: security-advisories@github.com
Resource:
Product
Release Notes
Hyperlink: https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93
Source: security-advisories@github.com
Resource:
Exploit
Mitigation
Vendor Advisory
Change History
0Changes found
Details not found