Read the docs
TI-2026-52876 Aliases CVE-2026-75511

Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed novu (novuhq): 3.18.0api-service (@novu): 3.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
novuhqnovubefore 3.18.03.18.0Patch availableCNA
@novuapi-servicebefore 3.18.03.18.0Patch availableCNA
  • novu Vendornovuhq Affected before 3.18.0 Fixed in 3.18.0 Patch available CNA
  • api-service Vendor@novu Affected before 3.18.0 Fixed in 3.18.0 Patch available CNA

Remediation

  • Fix · CNA novu (novuhq) Fixed in 3.18.0
  • Fix · CNA api-service (@novu) Fixed in 3.18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75511

References

Other 4

  • TI-2026-52875 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme CVSS 4.0MEDIUM 5.1
  • TI-2026-52880 Novu: Cross-Environment Integration Manipulation (IDOR) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences