CVE-2025-68475

HIGH

Fedify < 1.6.13, 1.7.0-1.7.13, 1.8.0-1.8.14, 1.9.0-1.9.1 - Regular Expression Denial of Service in HTML Parser

Title source: llm
STIX 2.1

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.

References (7)

Core 7

Scores

CVSS v3 7.5
EPSS 0.0048
EPSS Percentile 37.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-1333
Status published
Products (6)
fedify/fedify < 1.6.13
fedify/fedify 0 - 1.6.13npm
fedify-dev/fedify < 1.6.13
fedify-dev/fedify >= 1.7.0, < 1.7.14
fedify-dev/fedify >= 1.8.0, < 1.8.15
fedify-dev/fedify >= 1.9.0, < 1.9.2
Published Dec 22, 2025
Tracked Since Feb 18, 2026