Fedify, a TypeScript library for federated server apps, implements Linked Data (LD) Signatures to ensure the authenticity of JSON-LD documents. An attacker can exploit the library’s handling of JSON-LD named-graph restructuring to create a document that is structurally different yet still validates against the original LD signature. This lets the attacker modify a third‑party signed activity that a Fedify‑powered server receives, effectively altering the content of a message that should be immutable. The vulnerability is an integrity violation that undermines trust in federated communication and is mapped to weaknesses such as improper data transfer, improper JSON handling, deserialization issues, and insufficient data validation.

The affected product is the Fedify library from fedify-dev. Versions before 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 are vulnerable. Each of these releases was patched in the listed corrective versions.

The CVSS score of 7 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation yet. Nevertheless, the attack vector is expected to be a crafted ActivityPub activity sent over the network to a Fedify‑powered server. If the compromised system accepts the activity, an adversary can inject or modify data that would otherwise be considered trustworthy.