@novu/api vulnerabilities

Latest @novu/api CVEs

Newest publication first

1. CVE-2026-125114 Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

   Published 2026-11-09

   High·CVSS 8.3 EPSS 0.32%

   Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post with...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.