CVE-2026-75511: Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Novuto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Novu deployments running versions before 3.18.0 are exposed where an authenticated user can control chat webhook URLs through subscriber credentials, channel endpoints, event payloads, or event overrides. The affected chat providers are Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip.
What does an attacker need to exploit this issue?
An attacker needs authentication and the ability to supply a webhook URL through one of the affected chat-provider URL fields. They can direct the Novu worker to send POST requests to internal or otherwise restricted destinations.
How can we tell whether our environment is affected?
Check the deployed Novu version; versions earlier than 3.18.0 are affected. Also review whether authenticated users can set webhook URLs in subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl for an affected chat provider.
What should we do if we cannot upgrade immediately?
Restrict who can authenticate and who can create or modify the affected webhook URL fields. Prevent the Novu worker from reaching internal and restricted network destinations until upgrading to 3.18.0 is possible.