Fedify에 꽤 예전 버전부터 존재했던 보안 취약점(CVE-2025-54888)이 어제 저녁에 발견되어서 (Ghost 팀에서 보고해 줬다), 오늘 아침에는 각종 관련 소프트웨어에 모두 보안 패치를 적용하느라 푸닥거리를 엄청 했다.
- 일단 Fedify 1.3 버전 대부터 존재했어서, Fedify 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5 버전을 릴리스해야 했고…
- Hollo 0.4 버전 대부터 해당 취약점이 존재하는 Fedify 버전을 사용했어서, Hollo 0.4.12, 0.5.7, 0.6.6 버전을 릴리스해야 했다.
- BotKit도 첫 버전인 0.1 버전 대부터 해당 취약점의 영향을 받아서, BotKit 0.1.2, 0.2.2 버전을 릴리스해야 했다.
- Hackers' Pub의 Fedify 버전도 물론 업데이트해야 했다.
- Ghost를 비롯해 주변에 Fedify를 쓴다는 것을 내가 알고 있는 분들에게는 따로 사적으로 연락을 취했다.
- 각종 채널에 보안 패치 안내를 올리는 것도 일이었다…
다 하고 나니까 오전이 사라져 있었다.
hollo.social
All #Fedify users must immedia…
All #Fedify users must immediately update to the latest patched versions. A #critical authentication bypass #vulnerability ([CVE-2025-54888](https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4)) has been discovered in Fedify that allows attackers to impersonate any #ActivityPub actor by sending forged activities signed with their own keys. This vulnerability affects all Fedify instances and enables complete actor impersonation across the federation network. Attackers can send fake posts and messages as any user, create or remove follows as any user, boost and share content as any user, and completely compromise the federation trust model. The vulnerability affects all Fedify instances but does not propagate to other ActivityPub implementations like Mastodon, which properly validate authentication before processing activities. The following versions contain the #security fix: [1.3.20](https://github.com/fedify-dev/fedify/releases/tag/1.3.20), [1.4.13](https://github.com/fedify-dev/fedify/releases/tag/1.4.13), [1.5.5](https://github.com/fedify-dev/fedify/releases/tag/1.5.5), [1.6.8](https://github.com/fedify-dev/fedify/releases/tag/1.6.8), [1.7.9](https://github.com/fedify-dev/fedify/releases/tag/1.7.9), and [1.8.5](https://github.com/fedify-dev/fedify/releases/tag/1.8.5). Users should update immediately using their package manager with commands such as `npm update @fedify/fedify`, `yarn upgrade @fedify/fedify`, `pnpm update @fedify/fedify`, `bun update @fedify/fedify`, or `deno update @fedify/fedify`. After updating, redeploy your application immediately and monitor recent activities for any suspicious content. Please also inform other Fedify operators about this critical update to ensure the security of the entire federation network. The safety and security of our community depends on immediate action. Please update now and feel free to leave comments below if you have any questions. #fedidev
All #Fedify users must immediately update to the latest patched versions. A #critical authentication bypass #vulnerability (CVE-2025-54888) has been discovered in Fedify that allows attackers to impersonate any #ActivityPub actor by sending forged activities signed with their own keys.
This vulnerability affects all Fedify instances and enables complete actor impersonation across the federation network. Attackers can send fake posts and messages as any user, create or remove follows as any user, boost and share content as any user, and completely compromise the federation trust model. The vulnerability affects all Fedify instances but does not propagate to other ActivityPub implementations like Mastodon, which properly validate authentication before processing activities.
The following versions contain the #security fix: 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, and 1.8.5. Users should update immediately using their package manager with commands such as npm update @fedify/fedify, yarn upgrade @fedify/fedify, pnpm update @fedify/fedify, bun update @fedify/fedify, or deno update @fedify/fedify.
After updating, redeploy your application immediately and monitor recent activities for any suspicious content. Please also inform other Fedify operators about this critical update to ensure the security of the entire federation network.
The safety and security of our community depends on immediate action. Please update now and feel free to leave comments below if you have any questions.
Release Fedify 1.8.5 · fedify-dev/fedify
Released on August 8, 2025. @fedify/fedify Fixed a critical authentication bypass vulnerability in the inbox handler that allowed unauthenticated attackers to impersonate any ActivityPub actor. Th...