CVE-2026-75510

creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:22+00:00| published-proof-of-concept| https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp...

@novu/nextjs (>=3.0.0-canary.0, <=3.17.0), @novu/react (>=3.0.0-canary.0, <=3.17.0) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.0)

@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.0 Source cves: CVE-2026-75510 Source advisory: GHSA-8GR3-5J6F-25GP...

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

GHSA-8GR3-5J6F-25GP Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

@novu/nextjs (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d), @novu/react (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: OSV:GHSA-8GR3-5J6F-25GP...

CVE-2026-75511

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75517

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75510

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

EUVD-2026-84538

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75517

Prior to version 3.18.0 , Novu is vulnerable to a cross-environment integration manipulation (IDOR) because mutation use cases—such as remove-integration , update-integration , auto-configure-integration , and set-integration-as-primary —fail to consistently enforce environmentId . An attacker wi...

CVE-2026-75517 Novu: Cross-Environment Integration Manipulation (IDOR)

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75517 Novu: Cross-Environment Integration Manipulation (IDOR)

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75517 Novu: Cross-Environment Integration Manipulation (IDOR)

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

EUVD-2026-84536

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511

Novu versions prior to 3.18.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The application accepts chat webhook URLs from multiple fields, such as subscriber credentials.webhookUrl, channel endpoint endpoint.url, and event payload.webhookUrl. Because these paths fail to apply esse...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

@apolitical/component-library (>=8.3.5-ac.0, <=8.3.18-beta.0), @novu/nextjs (>=2.5.0, <=3.17.1-rc.1-rc.da35e9062d) +2 more potentially affected by CVE-2026-75510 via @novu/js (>=2.6.3, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =2.6.3, =8.3.5-ac.0, =2.5.0, =2.0.0-alpha.0, =2.2.0-rc.2, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: MEND:CVE-2026-75510...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...