{"id":"CVE-2026-125115","published":"2026-11-09T23:17:21.760","lastModified":"2026-11-10T19:21:06.720","description":"Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/novuhq/novu/pull/11197","tags":[]},{"url":"https://github.com/novuhq/novu/releases/tag/v3.17.0","tags":[]},{"url":"https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq","tags":[]}],"exploitRefs":[{"url":"https://github.com/novuhq/novu/pull/11197","tags":[]},{"url":"https://github.com/novuhq/novu/releases/tag/v3.17.0","tags":[]},{"url":"https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq","tags":[]}],"hasPoc":true,"ai":null}