CVE-2026-75511

Novu versions prior to 3.18.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The application accepts chat webhook URLs from multiple fields, such as subscriber credentials.webhookUrl, channel endpoint endpoint.url, and event payload.webhookUrl. Because these paths fail to apply esse...