CVE-2026-42462: Fedify JSON-LD Signature Bypass Vulnerability – Patch Now

Technical summary

The vulnerability stems from Fedify's handling of JSON-LD canonicalization and Linked Data Signature validation. JSON-LD's flexibility allows multiple semantically equivalent document structures, but Fedify did not properly normalize or validate the canonical form before verifying signatures. An attacker can reshape a JSON-LD document using features like @context reordering, property aliasing, or node compaction to change how Fedify interprets the activity (for example, changing the recipient or action type) without triggering signature validation failure. The affected versions fail to enforce strict canonical form matching between signature creation and verification, creating a signature malleability vulnerability. The fix implemented in patched versions ensures that JSON-LD canonicalization is performed consistently and that signature validation rejects documents that deviate from the expected canonical representation.

Business impact

For organizations deploying Fedify-based federated services, this vulnerability enables account takeover, message forgery, and trust chain compromise. An attacker could intercept and modify Follow requests, Like activities, or administrative actions originating from trusted federated peers, causing the receiving server to perform unintended actions attributed to legitimate senders. In social networks, messaging platforms, or collaborative systems built on ActivityPub, this could lead to unauthorized access, data manipulation, or service disruption. The trust model of federated systems depends entirely on signature verification; compromise of that mechanism undermines the entire security posture.

Affected systems

All Fedify versions prior to 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 are vulnerable. The vulnerability affects all minor and patch versions in the following release lines: 1.x (before 1.9.11), 1.10.x (before 1.10.10), 2.0.x (before 2.0.18), 2.1.x (before 2.1.14), and 2.2.x (before 2.2.3). Any application or service that directly imports and uses Fedify for ActivityPub server implementation is at risk if running an unpatched version.

Exploitability

Exploitation requires network access to intercept or receive signed ActivityPub activities, but does not require authentication, user interaction, or special privileges. The attacker must have knowledge of JSON-LD manipulation techniques and the specific activity structure they wish to alter. The CVSS score of 7.0 (HIGH) reflects that while the attack is feasible without authentication, it involves moderate complexity and specific prerequisites. The vulnerability is not known to be actively exploited in the wild, and no proof-of-concept has been widely disclosed, reducing immediate risk but not eliminating the need for prompt patching.

Remediation

Upgrade Fedify to version 1.9.11, 1.10.10, 2.0.18, 2.1.14, or 2.2.3 or later, depending on your current release line. Organizations should prioritize patching based on their deployment scale and exposure to federated peers. After upgrading, existing signed activities will continue to validate correctly; only newly received activities benefit from the stricter signature validation. No configuration changes or key rotation are required, though auditing recent activity logs for suspicious restructured documents is prudent for high-security deployments.

Patch guidance

Review your current Fedify version against the fixed versions listed: 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3. Update your package.json or lock files to reference the fixed version in your release line. For production deployments, consider staging the upgrade in a test environment first to verify compatibility with your specific ActivityPub implementation and federated peers. The patches maintain backward compatibility with the public API; integration testing should focus on signature validation and activity processing workflows rather than code changes.

Detection guidance

Monitor for anomalous activities received from federated peers that appear to have valid signatures but exhibit unexpected or contradictory content (e.g., ownership mismatches, actor/recipient inversions). Log and review any activities that pass initial validation but fail semantic or business-logic checks. Implement secondary validation of critical activities (Create, Delete, Update on sensitive objects) by re-requesting confirmation from the originating server. Network-level detection is difficult without deep JSON-LD parsing; focus defenses on application-level validation and anomaly detection in activity patterns.

Why prioritize this

While not yet in active exploitation, this vulnerability directly compromises the cryptographic trust model of federated systems. Organizations operating ActivityPub-based services should patch promptly because federated trust is irreversible—a compromised signature on a widely distributed activity can persist indefinitely. The HIGH severity and potential for supply-chain-like attacks (where a trusted peer's activities are silently modified) warrant fast-track patching, especially for public-facing or multi-tenant deployments. Organizations with smaller, closed federation networks may deprioritize slightly but should still patch within standard cycles.

Risk score, explained

The CVSS 3.1 score of 7.0 (HIGH) reflects: Network accessibility (AV:N) with no authentication required (PR:N); moderate attack complexity (AC:H) due to JSON-LD manipulation expertise; unchanged scope (S:U); and impacts spanning confidentiality (L), integrity (H), and availability (L). The high integrity impact drives the overall severity, as the attacker can modify activity content. The attack complexity is not Low because it requires specific knowledge of JSON-LD semantics and the target document structure, but it is achievable by a skilled attacker.

Frequently asked questions