API Notification Service Vulnerability in Novu by NovuHQ
CVE-2026-125115

6.8MEDIUM

Key Information:

Vendor

Novuhq

Status
Novu
Application-generic
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125115?

The Novu API, used for notification services, has a vulnerability in its URL validation feature before version 3.17.0. This issue revolves around incorrect handling of the isPrivateIp deny-list, which fails to account for the RFC6598 shared address space (100.64.0.0/10) and its respective IPv4-mapped IPv6 formats. Consequently, attackers can exploit this validation lapse to send unauthorized server-side requests, potentially revealing sensitive information such as instance metadata in cloud environments or accessing internal services within self-hosted setups. The risk is heightened in multi-tenant deployments where private infrastructure remains exposed. The issue has been addressed in the release of version 3.17.0.

Affected Version(s)

application-generic < 3.17.0

novu < 3.17.0

References

https://github.com/novuhq/novu/security/advisories/GHSA-v...
x_refsource_CONFIRM
https://github.com/novuhq/novu/pull/11197
x_refsource_MISC
https://github.com/novuhq/novu/releases/tag/v3.17.0
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.