Executive brief
ntfy is an open-source notification service used to send push notifications to devices via HTTP. A security flaw in how the service validates web push addresses allows an attacker to trick the server into making unauthorized requests to internal systems or other websites. This could lead to the exposure of sensitive internal network information or unauthorized access to internal services.
Technical details
ntfy versions prior to 2.22.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The root cause is an unanchored regular expression used to validate web push endpoint URLs against an allow-list. Because the regex lacks proper start/end anchors, an attacker can craft a malicious URL that contains a legitimate allow-listed domain as a substring while actually resolving to an arbitrary internal or external IP address. A remote attacker with the ability to configure web push endpoints can exploit this to probe internal network infrastructure or access cloud metadata services. The issue was addressed in version 2.22.0 by tightening the regex pattern matching.
Affected products
- ntfy ntfy < 2.22.0
Timeline
- 2025-03-06: disclosed: Vulnerability reported to maintainer
- 2025-04-21: patched: Fix released in v2.22.0
- 2026-04-23: advisory: CVE published