Fedify, a TypeScript library for building federated server applications, contains a resource exhaustion flaw. The library follows HTTP redirects recursively when resolving remote ActivityPub keys or documents without imposing a limit or cycle detection. An attacker who supplies a malicious key or actor URL can trigger an infinite redirect chain. The library will then perform repeated outbound HTTP requests for each hop, consuming network and server resources, potentially leading to denial of service for the application.

The issue affects all Fedify versions before 1.9.6 for the core library, before 1.10.5, before 2.0.8, and before 2.1.1. Projects that depend on @fedify/fedify or @fedify/vocab-runtime and that load remote keys or documents are vulnerable.

The CVSS score of 7.5 indicates a high severity. No exploit probability data is available, and the flaw is not listed in CISA’s KEV catalog. Because the vulnerability relies on untrusted HTTP redirects, a remote attacker with control over the URL being resolved can trigger the attack without needing local privileges. The impact remains limited to the server running Fedify, but repeated outbound traffic can exhaust bandwidth or processing capacity, resulting in service interruption.