{"affected":[{"product":"novu","source":"CNA: GitHub_M","vendor":"novuhq","versions":[{"status":"affected","version":"< 3.17.0"}]},{"product":"application-generic","source":"CNA: GitHub_M","vendor":"@novu","versions":[{"status":"affected","version":"< 3.17.0"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@novu/application-generic","product":"@novu/application-generic","source":"OSV GHSA-vg6v-j97m-h5xq","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"3.17.0"}],"lessThan":"3.17.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125115","cwes":["CWE-918"],"description":"Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},{"score":6.8,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794266241760,"publishedAt":1794262595104,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/novuhq/novu/pull/11197"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/novuhq/novu/releases/tag/v3.17.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/novuhq/novu/pull/11197"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/novuhq/novu/releases/tag/v3.17.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-vg6v-j97m-h5xq"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-vg6v-j97m-h5xq"}],"remediation":[{"kind":"fix","source":"OSV GHSA-vg6v-j97m-h5xq","text":"@novu/application-generic (npm): OSV reports a fixed version 3.17.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-vg6v-j97m-h5xq"}],"revision":"7a7191afe91d732389731ef58891d48fc595bea33aa54e02be142c268f7b59c1","sources":[{"modifiedAt":1794262595104,"name":"CNA: GitHub_M","retrievedAt":1794265801864,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125115"},{"modifiedAt":1794266241760,"name":"NVD","retrievedAt":1794270014998,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125115"},{"modifiedAt":1794263404190,"name":"OSV / GitHub Security Advisories","retrievedAt":1794265802652,"url":"https://osv.dev/vulnerability/GHSA-vg6v-j97m-h5xq"}],"ssvc":null,"status":"published","title":"Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition","updatedAt":1794270014998}