# Mastodon v4.5.20 fixes ActivityPub identifier verification vulnerability

> **Key takeaway:** Mastodon v4.5.20 addresses a security flaw in ActivityPub identifier verification and updates core dependencies.

**Published:** 2026-10-29T14:13:05+00:00 
**Source:** Mastodon Fediverse Platform 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/mastodon-v4520-fixes-activitypub-identifier-verification-vul.html 

## Summary
The Mastodon project has released version 4.5.20, a maintenance update focused on security and dependency management. This release specifically addresses a vulnerability regarding insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j).

Administrators are encouraged to upgrade promptly, particularly those utilizing OpenStack Swift for object storage, as known security issues exist in certain dependencies. This update also includes a change to the default Ruby version and resolves inefficiencies in hashtag timeline queries.

## Security fixes and technical changes in v4.5.20
- **Security Vulnerability:** Fixes GHSA-288h-6j8h-6x5j, which involved insufficient verification of ActivityPub identifiers.
- **Dependency Updates:** Addresses security advisories within the Ruby, NodeJS, and sanitize libraries.
- **Performance Optimization:** Resolves an inefficiency affecting the execution of certain hashtag timeline queries.
- **Runtime Environment:** Updates the default Ruby version requirement, necessitating careful environment configuration for non-Docker installations.
- **Development Tooling:** Fixes errors within the dev:populate_sample_data task used during development.

## Why it matters
This update is critical for Fediverse instance administrators to maintain protocol integrity and protect against identifier-based exploits. The warning regarding OpenStack Swift highlights the importance of monitoring the security posture of the underlying storage infrastructure in decentralized social networking.