Executive brief
Novu is a notification platform that routes messages across multiple channels including chat services. Prior to version 3.18.0, authenticated users could supply webhook URLs pointing to internal network services, allowing the Novu worker to issue HTTP requests to restricted destinations. An attacker could exploit this to interact with internal APIs or trigger unauthorized actions on internal systems.
Technical details
Nine chat providers (Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip) accepted webhook URLs from subscriber credentials, channel endpoints, and event payloads, then passed them to raw HTTP requests via axios without applying URL normalization, outbound URL validation, or DNS-pinned request protections. An authenticated attacker could supply internal or restricted URLs to bypass SSRF protections and cause the Novu worker to make HTTP POST requests to internal network services. The issue is fixed in 3.18.0 by routing all chat webhook delivery through a centralized safe-chat-webhook-request helper that applies consistent outbound URL validation.
Affected products
- Novu Novu before 3.18.0
Timeline
- 2026-09-22: disclosed
- 2026-06-07: patched