A vulnerability in the Fedify library allows unauthenticated remote attackers to cause a denial of service through recursive HTTP redirect loops.

The library fails to enforce a maximum redirect count or detect loops during remote document loading, allowing an unauthenticated attacker to force the server into an infinite request cycle.

Successful exploitation results in a denial of service, which can render federated server applications unresponsive and disrupt ActivityPub network operations. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to service availability and system stability for organizations relying on the Fedify framework.

Immediate Action: Update the @fedify/fedify and @fedify/vocab-runtime packages to the patched versions (1.9.6, 1.10.5, 2.0.8, or 2.1.1 depending on your current branch) immediately.

Proactive Monitoring: Monitor server egress traffic for unexpected spikes in outbound HTTP requests and review application logs for anomalies indicative of recursive redirect loops.

Compensating Controls: Deploy a Web Application Firewall or egress filtering rules to limit the frequency and duration of outbound connections initiated by the application document loader.

Public Exploit Available: No (exploit_available unknown)

This vulnerability presents a clear risk to service availability for all Fedify-based applications. Administrators should prioritize updating the library to the specified patched versions to prevent potential denial of service attacks. Failure to patch leaves the underlying infrastructure susceptible to resource exhaustion by unauthenticated actors.