CVE-2026-75511

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.

• CWE-918

• https://github.com/novuhq/novu/commit/dabfd66457c0b98ad46a8186e69f74f570a990c2
• https://github.com/novuhq/novu/pull/11455
• https://github.com/novuhq/novu/releases/tag/v3.18.0
• https://github.com/novuhq/novu/security/advisories/GHSA-pg9q-8v57-hqph

Published

Sep 22, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75498Webkul QloApps does not validate request parameters before a…7.2
• CVE-2026-7550A vulnerability has been found in SourceCodester Pharmacy Sa…7.3
• CVE-2026-75501Rejected reason: Vendor could not replicate the vul, and rep…
• CVE-2026-75509joserfc is a Python library that provides an implementation …6.5
• CVE-2026-7551HKUDS OpenHarness contains a remote code execution vulnerabi…8.8
• CVE-2026-75510Novu provides an API for sending notifications through multi…5.1
• CVE-2026-75513Marten is a .NET Transactional Document DB and Event Store o…9.1
• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-75516The RabbitMQ Java client library allows Java and JVM-based a…8.7
• CVE-2026-75517Novu provides an API for sending notifications through multi…6.5
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75523Steeltoe is an open source project that provides a collectio…5.9