CVE-2026-125115: Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Q: Which deployments are most exposed to this issue?

Deployments where Novu can reach services over the 100.64.0.0/10 shared address range are exposed. This includes Alibaba Cloud environments, where 100.100.100.200 may provide instance metadata, and self-hosted or multi-tenant environments with CGNAT-addressed internal services, infrastructure, service meshes, or VPN resources.

Q: What access does an attacker need to exploit it?

An attacker needs the ability to cause a Workflow HTTP request step or webhook filter condition to use a literal address or a hostname that resolves to an address in 100.64.0.0/10. Exploitation also requires user interaction according to the provided vector.

Q: Are IPv4-mapped IPv6 addresses affected?

Yes. The validation gap also applies to IPv4-mapped IPv6 forms of addresses in the 100.64.0.0/10 range.

Q: What version fixes the issue?

Upgrade Novu to version 3.17.0, which fixes the SSRF validation issue.

Published Nov 9, 2026

Updated

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.

Affected Software

1 affected component

Novu Novu<3.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Novu to a version that resolves this vulnerability.
Fixed in 3.17.0

Event History

Nov 9, 2026

CVE Published

via MITRE·10:16 PM

Data Sourced

via MITRE·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments where Novu can reach services over the 100.64.0.0/10 shared address range are exposed. This includes Alibaba Cloud environments, where 100.100.100.200 may provide instance metadata, and self-hosted or multi-tenant environments with CGNAT-addressed internal services, infrastructure, service meshes, or VPN resources.

What access does an attacker need to exploit it?

An attacker needs the ability to cause a Workflow HTTP request step or webhook filter condition to use a literal address or a hostname that resolves to an address in 100.64.0.0/10. Exploitation also requires user interaction according to the provided vector.

Are IPv4-mapped IPv6 addresses affected?

Yes. The validation gap also applies to IPv4-mapped IPv6 forms of addresses in the 100.64.0.0/10 range.

What version fixes the issue?

Upgrade Novu to version 3.17.0, which fixes the SSRF validation issue.

CVE-2026-125115: Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What access does an attacker need to exploit it?

Are IPv4-mapped IPv6 addresses affected?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What access does an attacker need to exploit it?

Are IPv4-mapped IPv6 addresses affected?

What version fixes the issue?