A critical Regular Expression Denial of Service vulnerability in the Fedify library allows unauthenticated remote attackers to crash server applications by processing specially crafted HTML content.

The flaw exists in the HTML parsing regex located at packages/fedify/src/runtime/docloader.ts, which contains nested quantifiers that cause CPU exhaustion when handling malicious input. This vulnerability is exploitable by unauthenticated attackers.

The ability for an unauthenticated attacker to cause a denial of service can lead to significant application downtime and service unavailability. Given the CVSS score of 7.5, this high severity issue poses a direct risk to the operational continuity of any federated server relying on the Fedify library.

Immediate Action: Update the Fedify library to version 1.6.13, 1.7.14, 1.8.15, 1.9.2, or later immediately.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes or recurring timeouts related to document loading processes.

Compensating Controls: Implement strict input validation or sanitization layers before passing external HTML content to the Fedify document loader to reduce the likelihood of malicious payloads reaching the vulnerable regex.

Public Exploit Available: Unknown

Organizations utilizing the Fedify library must prioritize upgrading to the patched versions listed above. Because this flaw is automatable and requires no authentication to trigger, the risk of automated service disruption is elevated. Please verify your dependency tree and apply the necessary updates as part of your next maintenance cycle to ensure system stability.