Executive brief
Novu's workflow and webhook filtering features include a security guard that blocks requests to private IP addresses, but it fails to block the shared address space (CGNAT) range 100.64.0.0/10. An attacker can exploit this gap to make the Novu service send HTTP requests to cloud metadata services (such as Alibaba Cloud's 100.100.100.200) or other internal services within that range, potentially exposing sensitive credentials or enabling further attacks on infrastructure.
Technical details
The vulnerability is an incomplete IP blocklist in the `validateUrlSsrf` function within @novu/application-generic. The guard uses a hand-written regex deny-list that covers RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, and link-local addresses, but omits the shared address space (CGNAT) range 100.64.0.0/10. This range is commonly used by cloud providers for metadata services and internal infrastructure. The flaw affects two product features: the Workflow HTTP request step and the Webhook filter condition, both of which call `validateUrlSsrf` before sending user-configured URLs. An attacker with workflow or webhook configuration privileges can bypass SSRF protection by specifying a URL in the 100.64.0.0/10 range. The vulnerability was patched in version 3.17.0 by expanding the regex blocklist to include this range.
Affected products
- Novu application-generic < 3.17.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched: Version 3.17.0 released with fix