Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.

Affected: npm: @fedify/fedify

Hi Fedify team! 👋

Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Service (ReDoS) vulnerability that I'd like to report. I hope this helps improve the project's security.

---

## Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at `packages/fedify/src/runtime/docloader.ts:259` contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses.

**An attacker-controlled federated server can respond with a small (~170 bytes) malicious HTML payload that blocks the victim's Node.js event loop for 14+ seconds, causing a Denial of Service.**

| Field | Value | |-------|-------| | **CWE** | CWE-1333 (Inefficient Regular Expression Complexity) |

---

## Details

### Vulnerable Code

The vulnerability is located in `packages/fedify/src/runtime/docloader.ts`, lines 258-264:

```typescript // Line 258-259: Vulnerable regex with nested quantifiers const p = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;

// Line 261: No size limit on response body const html = await response.text();

// Line 264: Regex execution loop while ((m = p.exec(html)) !== null) rawAttribs.push(m[2]); ```

### Root Cause Analysis

The regex has **nested quantifiers with alternation**, which is a classic ReDoS pattern:

``` /<(a|link)((\s+…