CVE-2026-125115

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.17.0

Description Novu contains a Server-Side Request Forgery (SSRF) flaw in the validateUrlSsrf function located in libs/application-generic/src/utils/ssrf-url-validation.ts. The issue stems from an incomplete deny-list in the isPrivateIp() function, which fails to block the RFC6598 100.64.0.0/10 shared address space (Carrier-Grade NAT) and its IPv4-mapped IPv6 equivalents. This allows the workflow HTTP request step and webhook filter condition to send unauthorized server-side requests to internal resources. In Alibaba Cloud environments, this can be used to access instance metadata via 100.100.100.200. In self-hosted or multi-tenant deployments, it may expose provider-internal services, private infrastructure, service meshes, or VPN resources.

Recommendations Update Novu to version 3.17.0. As a temporary mitigation, restrict the use of the validateUrlSsrf function or limit outbound HTTP requests from the workflow HTTP request step and webhook filter condition to known public IP ranges.