Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
- Exploited
- No known exploitation
- Fix
- Fixed in 3.17.0
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 3.17.0.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Novu's workflow HTTP request step and webhook filter condition can be used to make the server send requests to addresses in the CGNAT range (100.64.0.0/10), which its SSRF validation fails to block. An attacker with low-privilege network access can trigger this with a user's interaction, potentially reading data from internal services or cloud instance metadata.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure3/25Reachable over the network · Unknown: No advisory context yet
- Reach10/20Affects npm packages
- Severity6.8/10CVSS 6.8
- No patch0/5No signal
What would change the score
- Would score about 75 if added to CISA KEV
- Would score about 70 if CISA's SSVC rates exploitation active
- Would score about 39 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 3.17.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- novuhq novu
fixed in 3.17.0
- @novu application-generic
fixed in 3.17.0
fixed in 3.17.0
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125115
Is CVE-2026-125115 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-125115?
novu: before 3.17.0. application-generic: before 3.17.0. @novu/application-generic (npm): before 3.17.0.Source: cve.now feed data
How do I fix CVE-2026-125115?
Upgrade to a fixed version: 3.17.0.Source: cve.now feed data