CVE-2026-125115

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...

EUVD-2026-120496

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...

CVE-2026-125115

Prior to version 3.17.0 , Novu is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete deny-list in the validateUrlSsrf function located at libs/application-generic/src/utils/ssrf-url-validation.ts. The isPrivateIp check fails to block the RFC6598 100.64.0.0/10 shared address spa...

CVE-2026-125115: novuhq, @novu: Novu provides an API for sending notifications through multiple channels

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...