hackers.pub

Fedify security updates: 2.0.35, 2.1.31, 2.2.20, 2.3.15, and 2.4.5

Fedify has patched two server-side request forgery (SSRF) vulnerabilities across its supported release lines: a medium-severity DNS rebinding flaw that bypassed private address checks during outbound network requests, and a low-severity issue in the CLI where unvalidated page and favicon lookups could target internal endpoints. The core DNS rebinding vulnerability stems from resolving hostnames separately during validation and connection phases, leaving operations like document loading, activity delivery, and WebFinger lookups susceptible to reaching private networks. While Node.js and Bun pin validated addresses directly—with specific version considerations for proxying and certificate checks on Bun—Deno environments cannot pin connections and require network-level mitigations such as specific permission flags or container firewalls. Operators must also upgrade the CLI tool separately or utilize flags to disable risky requests. Understanding these runtime nuances and version requirements is crucial for ensuring internal network boundaries remain thoroughly protected against SSRF exploits.