The vulnerability CVE-2026-62857 in fedify affects multiple maintenance lines from version 1.2.0 through various subsequent versions before their respective fixed releases. The getNodeInfo() function improperly handles URLs from the /.well-known/nodeinfo endpoint by following attacker-controlled href values without validating the URL scheme, redirects, or whether the address is private or internal. This SSRF flaw enables an attacker to induce the server to make unauthorized requests to internal services, including loopback interfaces, link-local addresses, cloud metadata services, and other private network resources, potentially exposing sensitive information. The vulnerability is resolved in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform unauthorized HTTP requests to internal or protected network resources. This can lead to exposure of sensitive data from internal services such as cloud metadata endpoints or private network hosts. The vulnerability does not require authentication or user interaction and has a high CVSS score of 8.8, indicating a significant security risk if exploited.

This vulnerability is fixed in fedify versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. Users should upgrade to these or later versions to remediate the issue. No official remediation level or temporary fixes are indicated beyond upgrading. Patch status is confirmed by the vendor advisory information embedded in the description.