Fedify is a TypeScript library for federated server applications. Its runtime document and media fetching functions perform a public‑URL validation step to prevent SSRF attacks. The validator relies on an IPv4 address routine that blocks private ranges but mistakenly accepts several special‑use, reserved, multicast and carrier‑grade NAT ranges as valid public destinations. This incomplete mitigation allows an attacker to craft URLs that resolve to internal or otherwise restricted IP addresses, potentially exposing internal network resources, credentials or sensitive data. The vulnerability can be leveraged whenever the library creates outbound HTTP(S) connections, giving an attacker possible access to confidential services, data leakage or further pivoting opportunities.

The affected products are fedify and vocab-runtime from fedify-dev. Versions from 0.11.2 up to but excluding the patched releases 1.9.12, 1.10.11, 2.0.19, 2.1.15 and 2.2.4 contain the flaw. Users running any of these releases should update to a newer patch level that contains the corrected IP‑range validation.

The CVSS score of 8.6 indicates high severity. EPSS is not available, but the lack of a KEV listing and the public nature of the flaw suggest that exploitation may be limited to environments where the application exposes functions that trigger network fetches. Attackers who can control or inject URLs into the library’s fetch mechanisms could exploit the bypass to initiate requests to internal infrastructure, enabling data exfiltration, privilege escalation, or further lateral movement. The incomplete validation creates a persistent SSC risk until the proper patch or mitigation is applied.