{"vulnerability": "cve-2026-50131", "sightings": [{"uuid": "8d19eb19-0afb-4c3a-b472-7430464e425d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mnrwxyyvdir2", "content": "### Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5\n\nIf you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF [\u2026]", "creation_timestamp": "2026-06-08T14:57:55.145967Z"}, {"uuid": "bb5ca124-96f4-4925-a9e2-81d3902daeb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mnrxlz2slhe2", "content": "### Hollo security updates: 0.7.18, 0.8.7, and 0.9.4\n\nIf you run Hollo, update to a patched release now. CVE-2026-50131 affects Fedify's SSRF protection, and Hollo depends on Fedify for ActivityPub federation.\n\nFedify guards against SSRF (Server-Side Request Forgery) when fetching remote [\u2026]", "creation_timestamp": "2026-06-08T15:09:05.707464Z"}, {"uuid": "803efc98-53ae-4bc4-9ddd-628da427271b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnt5okxrpl2a", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 137 interactions\nCVE-2015-5119: 20 interactions\nCVE-2020-0601: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50751: 6 interactions\nCVE-2025-8088: 5 interactions\nCVE-2026-50131: 5 interactions\n", "creation_timestamp": "2026-06-09T02:30:30.807490Z"}, {"uuid": "5bf4af89-cada-4e69-b3e1-0008c64e9ab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnxsdlo6672x", "content": "CVE-2026-50131 - Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges\nCVE ID : CVE-2026-50131\n \n Published : June 10, 2026, 8:27 p.m. | 50\u00a0minutes ago\n \n Description : Fedify is a TypeScript library for building f...", "creation_timestamp": "2026-06-10T22:51:04.533382Z"}, {"uuid": "dd1ac896-fccb-47ea-ac2b-f31f7ebcff93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxsve6fp726", "content": "\ud83d\udfe0 CVE-2026-50131 - High (8.6)\n\nFedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-50131/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T23:00:46.126401Z"}, {"uuid": "a2da1b9c-1ccf-41dd-aa2f-e2db9afbac1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:06.716575Z"}, {"uuid": "3a25fe72-d760-44b5-a43d-1cb2afb9af5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T01:00:11.006272Z"}, {"uuid": "ec8085dc-12e4-4f52-b649-9decf74ef82c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "https://gist.github.com/alon710/8c969173ef01652db3c3dd0115519a9e", "content": "# CVE-2026-50131: CVE-2026-50131: Server-Side Request Forgery Validation Bypass in Fedify\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50131\n\n## Summary\nFedify, a TypeScript framework for ActivityPub servers, implemented incomplete public URL validation inside the @fedify/fedify and @fedify/vocab-runtime libraries. The validator only blocked basic RFC 1918 networks, standard loopbacks, and link-local addresses, failing to restrict Carrier-Grade NAT (CGNAT), benchmarking, reserved, or IPv6 transition addresses. Consequently, unauthenticated remote attackers can bypass SSRF filters to access sensitive internal microservices and endpoints.\n\n## TL;DR\nIncomplete IP validation in Fedify enables unauthenticated remote attackers to bypass SSRF protections and access internal services by using CGNAT, benchmarking, and IPv6 transition IP addresses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.6\n- **EPSS Score**: 0.00269 (0.269%)\n- **Impact**: High Confidentiality, Low Integrity, Low Availability\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fedify\n- @fedify/fedify\n- @fedify/vocab-runtime\n- **@fedify/fedify**: >= 0.11.2, < 1.9.12 (Fixed in: `1.9.12`)\n- **@fedify/fedify**: >= 1.10.0, < 1.10.11 (Fixed in: `1.10.11`)\n- **@fedify/fedify**: >= 2.0.0, < 2.0.19 (Fixed in: `2.0.19`)\n- **@fedify/fedify**: >= 2.1.0, < 2.1.15 (Fixed in: `2.1.15`)\n- **@fedify/fedify**: >= 2.2.0, < 2.2.4 (Fixed in: `2.2.4`)\n- **@fedify/vocab-runtime**: < 2.0.19 (Fixed in: `2.0.19`)\n- **@fedify/vocab-runtime**: >= 2.1.0, < 2.1.15 (Fixed in: `2.1.15`)\n- **@fedify/vocab-runtime**: >= 2.2.0, < 2.2.4 (Fixed in: `2.2.4`)\n\n## Mitigation\n\n- Upgrade Fedify and Vocab-Runtime packages immediately\n- Enforce network-level egress blocking for private subnets\n- Pin HTTP requests strictly to validated IP addresses to prevent DNS rebinding\n\n**Remediation Steps:**\n1. Audit the current codebase dependencies using package-lock.json or pnpm-lock.yaml for vulnerable versions of @fedify/fedify (< 1.9.12, < 1.10.11, < 2.0.19, < 2.1.15, < 2.2.4).\n2. Update the dependency configuration to specify secure, patched versions.\n3. Deploy the updated software to production servers.\n4. Configure network edge routers and container configurations to drop outbound traffic originating from application servers directed to private or CGNAT addresses.\n\n## References\n\n- [GitHub Security Advisory GHSA-xw9q-2mv6-9fr8](https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8)\n- [GitHub Repository - CVE-2026-50131 Analysis and PoC Index](https://github.com/chaitanyagarware/CVE-2026-50131)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50131) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T18:41:49.908541Z"}, {"uuid": "159d5e3c-0070-4270-b221-99cf5b212c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50131", "type": "published-proof-of-concept", "source": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8", "content": "", "creation_timestamp": "2026-07-14T20:35:06.885669Z"}, {"uuid": "09319407-5ebc-42d0-98b3-6049afc4e9b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92590", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-50131\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:49:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:33.549080Z"}, {"uuid": "218ef669-94c7-42fe-a129-0addbe661fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-16T19:00:15.920549Z"}, {"uuid": "9d42a21c-61f2-44e9-8c5b-5dd4e08b0ec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-16T19:00:16.025105Z"}, {"uuid": "eadd75a2-c902-4293-859f-d735f1ab573a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-17T00:00:31.385255Z"}, {"uuid": "d23730cf-c3a8-4aac-8e87-c06f3f884279", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-17T00:00:31.469788Z"}, {"uuid": "ed438769-6a29-4d62-84d7-fcd5652048e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "published-proof-of-concept", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-18T00:00:41.378103Z"}, {"uuid": "6baf156d-d051-4642-97c7-ffc6fc99937a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50131", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-18T00:00:41.179574Z"}]}