7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42462

CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Summary

An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received.

Details

The vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and JSON-LD offering many ways to represent the same graph.

One of the issues is that by taking a signed Activity with an embedded object, an attacker can move the top-level Activity to a @graph property and move the activity's object to the top-level. Such a transformation preserves the signature and changes how the payload is interpreted by pretty much all ActivityPub implementations, making them process the object and ignore the formely-top-level activity. This can be used when the graph contains an embedded activity. In Mastodon, that is the case of { "type": "Undo", "object": { "type": "Announce" } }, but other implementations may sign other activities that can be exploited in the same way.

The @reverse keyword can also be used to change the shape of a JSON-LD document without changing the underlying graph, and could be used in a similar way to reverse an Activity and its object.

Another problematic feature is @included, which can be used to “move” properties outside of the normal tree, effectively making them invisible to most ActivityPub implementations, while, again, preserving the signature. This allows removing statuses or actor properties once a signed Create or Update activity is received.

Given that Fedify have seen no use of @graph, @included or @reverse in ActivityPub payloads and that they are very complex to handle correctly (the only JSON-LD API functions that “normalize” @included and @reverse are flattening and framing, which both lose the root node), a decision to reject them has been made, and it is recommended for users do so as well.

Miggo Vulnerability Database

→

CVE-2026-42462

CVE-2026-42462:

7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@fedify/fedify	npm	< 2.2.3	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-42462, is a Linked Data Signature bypass in Fedify caused by improper validation of JSON-LD documents. The root cause is a failure to canonicalize the incoming JSON-LD payload before performing cryptographic signature verification. An attacker can exploit JSON-LD features such as @graph, @included, and @reverse to restructure a signed document. This restructured document maintains a valid signature because its canonical RDF graph representation remains unchanged, but it is interpreted differently by the application, leading to a bypass of the signature's integrity guarantee.

The analysis of the patch commit f6c1e55cecc1bfaf8d069080008694dfcec75540 reveals the vulnerable functions and the mitigation strategy. The core of the vulnerability was in the verifyJsonLd function in packages/fedify/src/sig/ld.ts, which previously verified signatures on un-normalized documents.

The primary entry points for exploiting this vulnerability are the handleInbox function, which processes live incoming activities, and the FederationImpl.processQueuedTask method, which processes activities from a queue. Both of these would have invoked the vulnerable verifyJsonLd logic.

The patch addresses this by:

Introducing a new compactJsonLd function to normalize the JSON-LD payload against a local context and reject disallowed keywords (@graph, @included, @reverse) via the assertSafeJsonLd function.
Modifying the signature verification logic (verifyJsonLd and the new verifyCompactJsonLd) to operate on the compacted, sanitized document.
Updating handleInbox and FederationImpl.processQueuedTask to use this new secure verification flow, ensuring that all activities, whether processed live or from a queue, are properly validated.

Vulnerable functions

verifyJsonLd

packages/fedify/src/sig/ld.ts

This function was responsible for verifying the Linked Data Signature of a JSON-LD document. Before the patch, it failed to normalize the document by compacting it against a local context. This allowed an attacker to use JSON-LD restructuring features like `@graph`, `@included`, or `@reverse` to craft a payload that is interpreted differently by the application after signature verification, effectively bypassing the signature's integrity protection.

handleInbox

packages/fedify/src/federation/handler.ts

This function serves as the main entry point for processing incoming activities. It was vulnerable because it orchestrated the parsing and verification of activities using the flawed `verifyJsonLd` function. An attacker could send a malicious, specially crafted JSON-LD payload to an inbox endpoint, which would be processed by this function, leading to the vulnerability being triggered.

FederationImpl.processQueuedTask

packages/fedify/src/federation/middleware.ts

This function processes activities from a message queue. It was vulnerable for the same reasons as `handleInbox`, as it would process queued JSON-LD activities without performing the necessary security checks like compaction and filtering of dangerous keywords. A malicious activity could be queued and later processed by this function, triggering the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Summary

Details

CVE-2026-42462:

7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

7

7

CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Summary

Details

Impact

7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Summary

Details

CVE-2026-42462:

7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

7

7

CVE-2026-42462: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Summary

Details

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI