Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-vg6v-j97m-h5xq | @novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 09 Nov 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0. | |
| Title | Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-09T22:16:35.104Z
Reserved: 2026-11-09T17:45:35.936Z
Link: CVE-2026-125115
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses