Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-125115— Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Quick assessment

Affected
novuhq novu
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Novu 提供了一套通过多种渠道发送通知的 API。在 3.17.0 版本之前， 中的 函数使用的私有 IP 地址黑名单未覆盖 RFC6598 定义的 100.64.0.0/10 共享地址空间，也未包含其 IPv4 映射的 IPv6 形式。因此，工作流中的 HTTP 请求步骤以及 Webhook 的过滤条件可能向该地址范围内的配置字面地址或解析后的主机名发起服务器端请求。在阿里云环境中，100.100.100.200 可能暴露实例元数据；而在自托管或多租户部署场景中，可能暴露通过 CGNAT（运营商级网络地址转换）

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-125115

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Source: CVE Program / CVE List V5
Vulnerability Description
Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
novuhq novu < 3.17.0 -
@novu application-generic < 3.17.0 -

II. Public POCs for CVE-2026-125115

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-125115

请登录查看更多情报信息。

Other References for CVE-2026-125115 (3)

IV. Related Vulnerabilities

Same product: novu
Same vendor: novuhq
Same weakness: CWE-918