CVE-2026-125114

Novu provides an API for sending notifications through multiple channels.

Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-125114