Quick answers
- Is CVE-2026-125115 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125115 being exploited in the wild.
- How severe is CVE-2026-125115?
- Medium severity, with a CVSS score of 6.8, published 9 November 2026.
- Which products and versions are affected?
- Novu before 3.17.0.
- Is there a fix for CVE-2026-125115?
- Yes: fixed in 3.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-125115 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-125115?
- Check whether you run Novu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.17.0
Technical details
The validateUrlSsrf function in the SSRF validation module used an incomplete deny-list that omitted the RFC6598 shared address space (100.64.0.0/10) and its IPv4-mapped IPv6 equivalents. This allowed HTTP workflow steps and webhook filter conditions to make server-side requests to addresses in that range, including cloud metadata endpoints and CGNAT-routed internal services. The fix adds regex patterns to block 100.64.0.0/10 and ::ffff: IPv4-mapped forms in both the shared and application-generic implementations.
Affected products
- Novu Novu before 3.17.0
Timeline
- 2026-11-09: disclosed
- 2026-05-21: patched