CVE-2026-125115 Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...

PT-2026-141159

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.17.0 Description Novu contains a Server-Side Request Forgery SSRF flaw in the validateUrlSsrf function located in libs/application-generic/src/utils/ssrf-url-validation.ts. The issue stems from an incomplete deny-list ...

PT-2026-69083

Hi Novu team, Reporting an SSRF blocklist gap in the shared validateUrlSsrf guard. A complete self-contained reproduction is inlined below — copy the four files into a directory and run docker compose up, plus a single-file probe that runs against Node directly. Locally validated against HEAD...