If you use BotKit, update to a patched release now. Two vulnerabilities affect Fedify versions included by BotKit as a dependency: CVE-2026-77632, a high-severity server-side request forgery vulnerability in the authenticated document loader, and CVE-2026-69132, a medium-severity denial-of-service vulnerability in the outbound delivery circuit breaker.

CVE-2026-77632 affects the authenticated document loader Fedify uses to fetch remote documents such as actors and public keys with signed HTTP requests. Affected versions checked that the initial URL was public, but did not apply the same check when the URL returned an HTTP redirect. An attacker who controlled the public URL could redirect the signed request to a loopback address, a link-local cloud metadata service, or an RFC 1918 host. In the ordinary inbox path, Fedify may fetch a signature's keyId before it can verify the signature, so a bogus signature is enough to reach this path. The demonstrated attack is blind SSRF: the internal response is consumed while resolving the remote document and is not automatically returned to the attacker.

The fix validates every redirect target before it is fetched. The existing allowPrivateAddress option continues to permit private destinations when an application explicitly opts in, such as for a closed federation or test environment.

CVE-2026-69132 affects the outbound delivery circuit breaker introduced in Fedify 2.3, which records delivery failures in the configured key–value store using the remote inbox's host:port as part of the key. An attacker could send signed Follow activities from actors whose inbox URLs pointed to distinct ports where delivery would fail. Each failure created a separate record, allowing the attacker to grow circuit-breaker state until storage or memory was exhausted. Fedify 2.3.0 and 2.3.1 were vulnerable with every circuit-breaker configuration. In versions 2.3.2 through 2.3.4, the vulnerable configuration was a custom failure policy without an explicit stateTtl.

The fix gives custom failure policies a bounded default stateTtl, equal to recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values). On stores that support compare-and-set operations, Fedify also sweeps circuit-breaker state left by affected releases and stamps it with a TTL.

BotKit 0.4.x versions through 0.4.5 and BotKit 0.5.x versions through 0.5.1 include a Fedify version affected by CVE-2026-77632. The circuit-breaker issue, CVE-2026-69132, affects only the BotKit 0.5.x line. Patched releases are BotKit 0.4.6 and 0.5.2. BotKit 0.4.6 uses Fedify 2.1.21, and BotKit 0.5.2 uses Fedify 2.3.5.

For BotKit 0.5.x, update @fedify/botkit:

npm update @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update @fedify/botkit
bun update @fedify/botkit
deno update @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm update @fedify/botkit@0.4.6
yarn upgrade @fedify/botkit@0.4.6
pnpm update @fedify/botkit@0.4.6
bun update @fedify/botkit@0.4.6
deno update @fedify/botkit@0.4.6

After updating, redeploy. The GitHub Security Advisories are GHSA-cxc3-7q96-6cpx and GHSA-fx98-wc5v-jrg5. See also Fedify's own announcement.

Thanks to Jace and @nyanrus for the reports and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.