Mastodon 4.6.11 patches two security flaws, fixes reverse-proxy header handling

The Mastodon project released version 4.6.11, a security-focused update for the open-source decentralized social network server. This release patches two disclosed vulnerabilities tracked as GHSA-cf49-73r7-rxj6 and GHSA-qp4r-p842-mw5c, both reported and fixed by developer ClearlyClaire. The first flaw allowed denial-of-service attacks through JSON-LD compaction processing, while the second involved the Forwarded HTTP header incorrectly taking precedence over X-Forwarded-For, potentially causing IP address spoofing in reverse-proxy deployments. Administrators using the project's provided nginx.conf are advised to update their configuration, and those with custom reverse-proxy setups must ensure user-supplied X-Forwarded-For headers are stripped.

Beyond the two primary fixes, the release updates Ruby dependencies to address security advisories in the addressable, loofah, rack, and rails-html-sanitizer gems. A minor behavioral change alters invite use counts so they no longer decrement when invited users delete their accounts. The upgrade path from 4.6.10 requires standard dependency installation and process restarts, with no external dependency changes from the 4.6.0 baseline.

Security fixes and reverse-proxy implications

• JSON-LD compaction DoS (GHSA-cf49-73r7-rxj6): The vulnerability allowed resource exhaustion through malicious JSON-LD compaction requests, a vector specific to Mastodon's ActivityPub implementation; the fix hardens parsing of linked data documents.
• Forwarded header precedence (GHSA-qp4r-p842-mw5c): Mastodon incorrectly prioritized the standardized Forwarded header over X-Forwarded-For, enabling IP address spoofing if attackers could inject X-Forwarded-For while a reverse proxy sent Forwarded; the fix corrects this precedence logic.
• Reverse-proxy configuration requirement: Instances using Forwarded headers must now explicitly drop user-provided X-Forwarded-For to prevent bypass; the project's bundled nginx.conf has been updated to reflect this.
• Dependency security updates: The addressable, loofah, rack, and rails-html-sanitizer gems were upgraded to patched versions, addressing upstream CVEs in Mastodon's Ruby dependency tree without requiring application code changes.
• Invite accounting change: A minor logic adjustment prevents invite use counts from decreasing when invited accounts are deleted, closing a potential abuse vector for infinite invite generation.

Why it matters

For the thousands of self-hosted Mastodon instances in the fediverse, this release is a mandatory security update given the remote-exploitable DoS vector and the IP spoofing risk in common reverse-proxy configurations. The dependency updates also reduce exposure to known vulnerabilities in widely-used Ruby infrastructure gems. Instance administrators running Docker or traditional deployments should prioritize this upgrade, verify their reverse-proxy header handling, and maintain database backups as advised in the release notes.