CVE-2025-68475: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68475 is a Regular Expression Denial of Service (ReDoS) vulnerability in Fedify's document loader (packages/fedify/src/runtime/docloader.ts, line 259). The HTML parsing regex contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses, allowing an attacker-controlled federated server to block the victim's Node.js event loop for 14+ seconds with a payload as small as ~170 bytes. It affects Fedify versions prior to 1.6.13, 1.7.14, 1.8.15, and 1.9.2 (all branches up to and including 1.9.1). The vulnerability was published on December 20, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable regex /\<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ ig uses nested quantifiers — an outer ((...)+) group wrapping an inner alternation — which is a classic ReDoS pattern. When the regex fails to match (e.g., on an incomplete or malformed HTML tag), the engine backtracks exponentially through all possible match combinations, exhibiting O(2^n) time complexity. Compounding the issue, the code read the entire HTTP response body via response.text() without any size limit, and no default timeout was enforced on the AbortSignal. The attack is triggered remotely when a Fedify application calls lookupObject(), getDocumentLoader(), or the built-in document loader to fetch content from an attacker-controlled URL that responds with Content-Type: text/html (GitHub Advisory, Fix Commit).

Successful exploitation causes a Denial of Service by blocking the Node.js event loop for 14+ seconds per malicious request, during which all other requests are queued and may time out. Because Node.js is single-threaded, a single malicious response can render the entire Fedify-based application unresponsive. Repeated or concurrent attacks can cause sustained service unavailability. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting all Fedify applications that federate with external servers (GitHub Advisory).

A public proof-of-concept (PoC) exploit script is available in the GitHub Security Advisory, demonstrating the exponential time complexity with payloads of varying sizes. No privileges, user interaction, or authentication are required — exploitation is trivially achievable by any operator of a federated server that a victim Fedify instance attempts to contact. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.111%, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Set up a malicious federated server: Configure a server at a domain (e.g., attacker.com) that responds to ActivityPub profile requests with Content-Type: text/html and a crafted malicious HTML payload.
2. Craft the malicious payload: Generate a ~170-byte HTML string containing repeated attribute-like patterns that trigger catastrophic backtracking in the vulnerable regex (e.g., 28+ repetitions of a pattern like <a x= x= x= ... without a closing >). The PoC demonstrates that 28 repetitions (~171 bytes) causes ~14 seconds of blocking.
3. Trigger the victim to fetch from the attacker's server: Initiate a federation action that causes the victim's Fedify application to call lookupObject("https://attacker.com/@user") — for example, by sending a follow request or mention from @attacker@attacker.com to a user on the victim server.
4. Exploit the document loader: The victim's Fedify app calls documentLoader() → getRemoteDocument(), which fetches the attacker's URL, reads the full response body without size limits, and applies the vulnerable regex to the malicious HTML.
5. Achieve DoS: The regex triggers catastrophic backtracking, blocking the Node.js event loop for 14+ seconds. Repeating or parallelizing requests sustains the denial of service (GitHub Advisory).

• Logs: Application logs showing repeated or sustained delays in lookupObject() or getDocumentLoader() calls; Node.js event loop lag warnings or timeouts originating from document loader operations; log entries referencing docloader.ts with unusually long execution times.
• Network: Outbound HTTP requests from the Fedify server to unfamiliar or newly registered federated domains returning Content-Type: text/html responses for ActivityPub actor profile URLs; responses with small body sizes (~100–200 bytes) that cause disproportionate processing time.
• Process: Node.js process CPU usage spiking to 100% for extended periods (14+ seconds) without corresponding high request volume; application health checks timing out or failing during normal operation.

Upgrade Fedify to a patched version based on your current branch: 1.6.13 (for 1.6.x), 1.7.14 (for 1.7.x), 1.8.15 (for 1.8.x), or 1.9.2 (for 1.9.x). The fix replaces the vulnerable nested-quantifier regex with safe, non-backtracking patterns and adds a 1MB HTML response size limit as an additional mitigation. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation (GitHub Advisory, Fix Commit, Release 1.6.13).

The vulnerability was reported by security researcher yueyueL and acknowledged by the Fedify maintainers, who released patches across all active version branches on December 20, 2025. The fix was co-authored with Claude (AI-assisted development), as noted in the commit message. The advisory was picked up by several vulnerability tracking services including Red Hat CVE database, INCIBE-CERT, and CISA's weekly vulnerability bulletin for the week of December 22, 2025 (GitHub Advisory, Fix Commit).