diff --git a/src/activitypub/inbox.js b/src/activitypub/inbox.js
index a4b4579f4d..a3a6648aa3 100644
--- a/src/activitypub/inbox.js
+++ b/src/activitypub/inbox.js
@@ -78,7 +78,7 @@ inbox.create = async (req) => {
 
 inbox.update = async (req) => {
 	const { actor, object } = req.body;
-	const isPublic = [...object.to, ...object.cc].includes(activitypub._constants.publicAddress);
+	const isPublic = [...(object.to || []), ...(object.cc || [])].includes(activitypub._constants.publicAddress);
 
 	// Origin checking
 	const actorHostname = new URL(actor).hostname;