# Mastodon v4.5.21 releases security fixes for DoS and header precedence

> **Key takeaway:** Mastodon v4.5.21 addresses a JSON-LD compaction Denial of Service vulnerability and corrects header handling logic to prevent spoofing.

**Published:** 2026-11-03T15:53:00+00:00 
**Source:** Mastodon Fediverse Platform 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/mastodon-v4521-releases-security-fixes-for-dos-and-header-pr.html 

## Summary
The Mastodon development team has released version 4.5.21, a maintenance update focused on critical security patches. The release addresses two specific vulnerabilities: a Denial of Service (DoS) flaw related to JSON-LD compaction and a logic error regarding how the application handles proxy headers.

Administrators are advised to update promptly, particularly those utilizing OpenStack Swift for object storage, as known security issues persist in certain dependencies. The update also includes dependency bumps for several Ruby-based libraries to mitigate existing security advisories.

## Security fixes and dependency updates
- **Denial of Service:** Fixed a vulnerability (GHSA-cf49-73r7-rxj6) where JSON-LD compaction could be exploited to cause a DoS.
- **Header Precedence:** Resolved an issue (GHSA-qp4r-p842-mw5c) where the 'Forwarded' header incorrectly took precedence over 'X-Forwarded-For', which could impact IP identification.
- **Dependency Patching:** Updated several core dependencies to address security advisories, specifically targeting addressable, loofah, rack, and rails-html-sanitizer.
- **Logic Adjustment:** Modified invite functionality so that user invite counts no longer decrease if an invited user subsequently deletes their account.

## Why it matters
This update is critical for Fediverse instance administrators to maintain service availability and prevent IP spoofing via misconfigured reverse proxies. Users relying on OpenStack Swift should prioritize upgrading to newer major versions to mitigate broader dependency risks.