CVE-2025-23221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23221
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23221.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-23221
Aliases
Published
2025-01-20T16:49:31.738Z
Modified
2026-02-11T13:48:21.383564Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L CVSS Calculator
Summary
Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism
Details

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23221.json"
}
References

Affected packages

Git / github.com/dahlia/fedify

Affected ranges

Type
GIT
Repo
https://github.com/dahlia/fedify
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fbfe4e13d83ef29a2c3c84f761eefe1ac4d41f1a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.14"
        }
    ]
}
Type
GIT
Repo
https://github.com/dahlia/fedify
Events
Introduced
2007d391d94f7cca657a9c8ddfd6658944e53014
Fixed
e06d8732d0f9a9a61f8b9578b3fb98e8ee0fd711
Database specific 
{
    "versions": [
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.1.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/dahlia/fedify
Events
Introduced
2e639046343bb81f47b3f7a571aaec6812f4168e
Fixed
d47268b1a1a2297ee323da13eccbe707c5c9dc55
Database specific 
{
    "versions": [
        {
            "introduced": "1.2.0"
        },
        {
            "fixed": "1.2.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/dahlia/fedify
Events
Introduced
6979c1db404bb7032e1bc18af3118318c6f66c6d
Fixed
91bd1d7e9a212d3b6733d7eb0c45d7aa7b64d279
Database specific 
{
    "versions": [
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.4"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.10.2
0.11.0
0.11.1
0.11.2
0.11.3
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.14.5
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
0.9.1
0.9.2
0.9.3
1.*
1.0.0
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.2.10
1.2.11
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23221.json"

Git / github.com/fedify-dev/fedify

Affected ranges

Type
GIT
Repo
https://github.com/fedify-dev/fedify
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8be3c2038eebf4ae12481683a1e809b314be3151
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c505eb82fcd6b5b17174c6659c29721bc801ab9a
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e921134dd5097586e4563ea80b9e8d1b5460a645

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.10.2
0.11.0
0.11.1
0.11.2
0.11.3
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.14.5
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
0.9.1
0.9.2
0.9.3
1.*
1.0.0
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23221.json"