Fedify has ReDoS Vulnerability in HTML Parsing Regex
Date: 2025-12
Affected: npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-68475
CWE: CWE-1333
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Service (ReDoS) vulnerability that I'd like to report. I hope this helps improve the project's security. --- ## Summary A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at `packages/fedify/src/runtime/docloader.ts:259` contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. **An attacker-controlled federated server can respond with a small (~170 bytes) malicious HTML payload that blocks the victim's Node.js event loop for 14+ seconds, causing a Denial of Service.** | Field | Value | |-------|-------| | **CWE** | CWE-1333 (Inefficient Regular Expression Complexity) | --- ## Details ### Vulnerable Code The vulnerability is located in `packages/fedify/src/runtime/docloader.ts`, lines 258-264: ```typescript // Line 258-259: Vulnerable regex with nested quantifiers const p = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig; // Line 261: No size limit on response body const html = await response.text(); // Line 264: Regex execution loop while ((m = p.exec(html)) !== null) rawAttribs.push(m[2]); ``` ### Root Cause Analysis The regex has **nested quantifiers with alternation**, which is a classic ReDoS pattern: ``` /<(a|link)((\s+[


Mitigations:

Architectural layers (MAESTRO):