diff --git a/src/activitypub/inbox.js b/src/activitypub/inbox.js
index 2887caac04..980709fb58 100644
--- a/src/activitypub/inbox.js
+++ b/src/activitypub/inbox.js
@@ -64,7 +64,7 @@ inbox.create = async (req) => {
 	const { object } = req.body;
 
 	// Alternative logic for non-public objects
-	const isPublic = [...object.to, ...object.cc].includes(activitypub._constants.publicAddress);
+	const isPublic = [...(object.to || []), ...(object.cc || [])].includes(activitypub._constants.publicAddress);
 	if (!isPublic) {
 		return await activitypub.notes.assertPrivate(object);
 	}
diff --git a/src/activitypub/notes.js b/src/activitypub/notes.js
index 2b6a0fceaa..ed0b1f6791 100644
--- a/src/activitypub/notes.js
+++ b/src/activitypub/notes.js
@@ -234,7 +234,7 @@ Notes.assertPrivate = async (object) => {
 	}
 
 	const localUids = [];
-	const recipients = new Set([...object.to, ...object.cc]);
+	const recipients = new Set([...(object.to || []), ...(object.cc || [])]);
 	await Promise.all(Array.from(recipients).map(async (value) => {
 		const { type, id } = await activitypub.helpers.resolveLocalId(value);
 		if (type === 'user') {