Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Date: 2026-05
Affected: npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-42462
CWE: CWE-1289
CWE-180
CWE-347
CWE-436
CVSS: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L)

As told on Discord earlier, multiple projects are affected, and we would like to coordinate. For now, we are aiming at a May 6th release date, but this is not set in stone yet. ### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. ### Details The vulnerability essentially boils down to the signature being on the canonical RDF graph representation of the JSON-LD document, and JSON-LD offering many ways to represent the same graph. One of the issues is that by taking a signed `Activity` with an embedded `object`, an attacker can move the top-level `Activity` to a `@graph` property and move the activity's `object` to the top-level. Such a transformation preserves the signature and changes how the payload is interpreted by pretty much all ActivityPub implementations, making them process the object and ignore the formely-top-level activity. This can be used when the graph contains an embedded activity. In Mastodon, that is the case of `{ "type": "Undo", "object": { "type": "Announce" } }`, but other implementations may sign other activities that can be exploited in the same way. The `@reverse` keyword can also be used to change the shape of a JSON-LD document without changing the underlying graph, and could be used in a similar way to reverse an `Activity` and its `object`. Anothe


Mitigations:

Architectural layers (MAESTRO):