Fedify, a TypeScript library used to build federated ActivityPub servers, follows HTTP redirects when loading remote keys or documents without limiting the number of redirects or detecting loops. An attacker who can control a remote ActivityPub key or actor URL can inject a redirect chain that causes the server to repeatedly request external resources. This diverted network traffic depletes system resources and can result in denial of service. The weakness falls under unbounded resource consumption (CWE‑400) and lack of resource limits (CWE‑770).

All versions of the @fedify/fedify library released before 1.9.6, 1.10.5, 2.0.8, and 2.1.1 are vulnerable. The accompanying @fedify/vocab-runtime component is affected in versions prior to 2.0.8 and 2.1.1, with the 2.1.0 release also enumerated as vulnerable. The issue is fixed in the cited releases of both packages.

The CVSS base score is 7.5, indicating high severity. The EPSS score is below 1%, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, if an attacker can supply a malicious key or actor URL that the server resolves, they can execute the vulnerability by directing the server to follow an endless redirect chain, consuming CPU, memory, and network I/O. The attack requires remote control of a referenced ActivityPub resource and can be launched from a single inbound request to the vulnerable server.