Verified against RFC 9421, draft-cavage-12, Mastodon 4.7.3 source, FEP-521a/fe34, GitHub security advisories; code tested in examples/verify-requests on 2026-10-15.
Known vulnerability classes
Experienced teams keep shipping the same few classes of ActivityPub bug, so test your implementation against each class below. Every entry links to the published advisory. The list draws on the Mastodon and Fedify advisory databases as of October 2026, and isn't exhaustive.
Impersonation: trusting who an object claims to be from
| Advisory | Project | Published | What went wrong |
|---|---|---|---|
| CVE-2024-23832 (critical) | Mastodon | 2024-02-01 | Insufficient origin validation allowed remote user impersonation and takeover |
| CVE-2024-25623 | Mastodon | 2024-02-17 | Missing media type check on fetched Activity Streams objects allowed impersonation |
| CVE-2024-37903 | Mastodon | 2024-07-04 | Improper authorship check on audience extension for existing posts |
| CVE-2026-50128 | Mastodon | 2026-06-03 | Spoofing of attribution domains |
| CVE-2026-96625 (critical) | Fedify | 2026-09-27 | Inbox signature checks didn't verify key ownership, so any actor could be impersonated |
Prevent it:
- Bind the signing key's owner to
activity.actor. - Require that the owner's actor document lists the key.
- Enforce same-origin rules for Create, Update and Delete.
- Require an ActivityPub
Content-Typeon fetched documents. - Serve user uploads from a separate origin.
See Verifying incoming requests.
Signature bypasses
| Advisory | Project | Published | What went wrong |
|---|---|---|---|
| CVE-2026-46349 | Mastodon | 2026-05-20 | LD-Signature bypass via JSON-LD named-graph restructuring |
| CVE-2026-42462 | Fedify | 2026-05-20 | The same named-graph bypass, in Fedify's Linked Data Signature verification |
| CVE-2026-48028 | Mastodon | 2026-05-20 | Integrity-protected JSON entries could be removed from signed activities |
Prevent it:
- Don't rely on legacy Linked Data Signatures.
- Prefer refetching from the origin, or FEP-8b32 proofs over a canonicalised document (
eddsa-jcs-2022). - Process only what was actually covered by the signature or proof.
Server-side request forgery (SSRF)
Every URL in an incoming activity, including keyId, actor, inReplyTo, attachments and NodeInfo links, is attacker-chosen.
| Advisory | Project | Published | What went wrong |
|---|---|---|---|
| CVE-2023-42450 | Mastodon | 2023-09-19 | Server-side request forgery |
| CVE-2026-46348 | Mastodon | 2026-05-20 | SSRF bypass via the IPv6 unspecified address :: |
| CVE-2026-72916 | Mastodon | 2026-07-27 | SSRF protection bypass via IPv4-compatible IPv6 addresses |
| CVE-2026-77632 | Fedify | 2026-08-26 | Redirect targets fetched with a signed request without re-validation |
Prevent it:
- Resolve DNS yourself and reject non-public addresses, including IPv6 special forms (
::,::ffff:a.b.c.d,::a.b.c.d, NAT64). - Connect to the address you validated.
- Re-validate every redirect hop.
See safe-fetch.js. Its tests include both IPv6 bypass forms above.
Resource exhaustion
| Advisory | Project | Published | What went wrong |
|---|---|---|---|
| CVE-2026-96623 | Fedify | 2026-09-27 | Remote ActivityPub and JSON-LD responses were parsed without a byte limit |
Prevent it: cap response sizes (Mastodon's HTTP client defaults to a 1 MB body limit), redirect chains and total fetch time. Bound any per-host state you keep.
Caching and access control
| Advisory | Project | Published | What went wrong |
|---|---|---|---|
| CVE-2026-25540 | Mastodon | 2026-02-03 | Collection responses that depend on the request signature were cached under keys that ignore it |
Prevent it: if a response depends on who is asking (authorized fetch, followers-only collections), include that in the cache key or mark the response private.