https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T17:55:24.239335+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-125114 fkie_cve-2026-125114 2026-11-11T17:55:24.241785+00:00

Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0.

 https://db.gcve.eu/vuln/ghsa-4x48-cgf9-q33f GHSA-4x48-cgf9-q33f — Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection 2026-11-11T17:55:24.241927+00:00

Affected: npm: @novu/api

## Summary

The conditions filter webhook at `libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts` line 261 sends POST requests to user-configured URLs using raw `axios.post()` with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses `validateUrlSsrf()` which blocks private IP ranges. The conditions webhook was not included in this protection.

## Root Cause

`conditions-filter.usecase.ts` line 261: ```typescript return await axios.post(child.webhookUrl, payload, config).then((response) => { return response.data as Record<string, unknown>; }); ```

No call to `validateUrlSsrf()`. The `webhookUrl` comes from the workflow condition configuration with zero validation.

## Protected Code (for contrast)

`execute-http-request-step.usecase.ts` line 130: ```typescript const ssrfValidationError = await validateUrlSsrf(url); if (ssrfValidationError) { // blocked } ```

This function resolves DNS and checks against private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). It exists in the codebase but is not applied to the conditions webhook path.

## Proof of Concept

1. Create a workflow with a condition step 2. Configure the condition's webhook URL to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` 3. Trigger the workflow by sending a notification event 4. The worker evaluates the condition and calls `axios.post()` to the metadata endpoint 5. The response data…