CVE-2026-125115

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.

• CWE-918

• https://github.com/novuhq/novu/pull/11197
• https://github.com/novuhq/novu/releases/tag/v3.17.0
• https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125104FFmpeg through 9.0.2 contains a memory exhaustion vulnerabil…5.5
• CVE-2026-125105Wagtail is an open source content management system built on…3.7
• CVE-2026-125107Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-125122compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125123compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125124compose-lint is a Docker Compose security linter that identi…2.3