Fedify, a TypeScript library used to build federated ActivityPub servers, contains an SSRF flaw in its getNodeInfo routine. The function follows a links[] href value supplied via /.well‑known/nodeinfo without enforcing scheme validation, redirect checks, or protecting against private-address resolution. When triggered, the library performs an outbound HTTP request to the resolved address and returns the response body back to the caller, effectively exposing the content of internal or cloud‑only services such as loopback, link‑local, or cloud metadata endpoints. This flaw is classified as CWE‑918 and represents a confidentiality breach that can also impact data integrity.

Fedify versions 1.2.0 through 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 are affected. The issue was resolved in version 1.9.13 and newer maintenance releases: 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the SSRF by supplying a malicious href in the NodeInfo request or via an altered payload sent to the server. Once activated, any service reachable from the server—whether on loopback, private, or cloud metadata networks—can be accessed, and its responses returned to the attacker. This attack requires network connectivity from the vulnerable server to the target address, but no prior authentication is needed on the target services.