CVE-2026-125114

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.15.0

Description An issue exists in the conditions filter webhook within libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts where the user-configured child.webhookUrl is passed directly to axios.post() without undergoing SSRF validation via the validateUrlSsrf() function. This allows an attacker to trigger a POST request to private or link-local services, such as AWS IMDSv1, during workflow condition evaluation. The resulting response data is stored in execution details and can be retrieved through the 'GET /execution-details' endpoint, potentially disclosing internal service data or credentials from POST-capable metadata services. SSRF (Server-Side Request Forgery) is a vulnerability where a server is tricked into making requests to an unintended location.

Recommendations Update Novu to version 3.15.0. As a temporary workaround, restrict the use of the child.webhookUrl parameter in workflow condition configurations to trusted external domains only.