Incorrect Behavior Order: Validate Before Canonicalize Affecting @fedify/fedify package, versions <1.9.11>=1.10.0 <1.10.10>=2.0.0 <2.0.18>=2.1.0 <2.1.14>=2.2.0 <2.2.3

@fedify/fedify is an An ActivityPub server framework

Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through manipulation of JSON-LD document structure using keywords such as @graph, @included, and @reverse. An attacker can alter the interpretation of signed activities, potentially modifying or removing attributes, replaying activities, or forging arbitrary content by restructuring the payload while preserving its signature. This can result in unauthorized changes to activity data, loss of integrity, and disruption of service by exploiting the way the application processes and verifies signed JSON-LD documents.

• GitHub Advisory
• GitHub Commit
• GitHub Release