From 6a0663cdd0a64dc300cdb6d04081005d1447d384 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Thu, 26 Feb 2026 15:57:16 -0500
Subject: [PATCH] fix: guard against crash when malformed URL present in
 deliverees

---
 src/activitypub/index.js | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/activitypub/index.js b/src/activitypub/index.js
index 85491b27b1..c5b5417020 100644
--- a/src/activitypub/index.js
+++ b/src/activitypub/index.js
@@ -135,11 +135,17 @@ ActivityPub.resolveInboxes = async (ids) => {
 	// Filter out blocked instances
 	const blocked = [];
 	inboxArr = inboxArr.filter((inbox) => {
-		const { hostname } = new URL(inbox);
-		const allowed = ActivityPub.instances.isAllowed(hostname);
-		if (!allowed) {
-			blocked.push(inbox);
+		let allowed = false;
+		try {
+			const { hostname } = new URL(inbox);
+			allowed = ActivityPub.instances.isAllowed(hostname);
+			if (!allowed) {
+				blocked.push(inbox);
+			}
+		} catch (e) {
+			winston.warn(`[activitypub/resolveInboxes] Malformed URL encountered while filtering out blocked instances: ${inbox}`);
 		}
+
 		return allowed;
 	});
 	if (blocked.length) {