We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
The Vulnerability
A security researcher identified multiple security issues in Fedify's
Changes
The security updates implement the following fixes:
Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks
How to Update
To update to the latest secure version:
The Vulnerability
A security researcher identified multiple security issues in Fedify's
lookupWebFinger() function that could be exploited to:
Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation
Fixed Versions
1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14Changes
The security updates implement the following fixes:
Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks
How to Update
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
