Novu SSRF in conditions filter webhook

Severity: info · CVSS 7.5 · Published 2026-04-14

Novu's notification workflow engine contains a server-side request forgery (SSRF) vulnerability in its conditions filter webhook feature. The vulnerability allows attackers who can configure workflow conditions to make the Novu worker process send HTTP POST requests to arbitrary internal services and cloud metadata endpoints (like AWS IMDSv1). The response data from these requests is stored and accessible via the API, enabling credential theft and reconnaissance of internal infrastructure.

Technologies: Novu API, Novu Worker. Vendors: Novu, npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, with a CVSS score of 7.5, published 14 April 2026.
Which products and versions are affected?
Novu API <3.15.0; Novu Worker <3.15.0; @novu/api (npm) SEMVER:introduced=0,fixed=3.15.0.
Is there a fix for This vulnerability?
Yes. @novu/api (npm): upgrade to 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Novu API, Novu Worker or @novu/api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @novu/api (npm): upgrade to 3.15.0 or later
    npm install @novu/api@3.15.0

Technical details

The vulnerability exists in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts at line 261, where user-supplied webhook URLs are passed directly to axios.post() without any SSRF validation. The codebase contains a validateUrlSsrf() function used elsewhere (in execute-http-request-step.usecase.ts) that blocks requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16), but this protection was not applied to the conditions webhook path. An attacker with the ability to create or modify workflow conditions can configure a malicious webhook URL pointing to cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) or internal services. When the workflow is triggered, the worker evaluates the condition and makes the unvalidated POST request, with response data stored in execution details and exposed via the GET /execution-details API. While AWS IMDSv2 requires GET and credentials in headers, AWS IMDSv1 accepts POST and returns credentials in the response body. The attack requires workflow configuration access but succeeds even if the attacker cannot directly trigger the workflow.

Affected products

  • Novu @novu/api <3.15.0
  • Novu @novu/worker <3.15.0

Timeline

  • 2026-04-14: disclosed: GHSA-4x48-cgf9-q33f published
  • 2026-03-25: patched: Fix committed; patched in version 3.15.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.