CVE-2026-125114 Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125114?
CVE-2026-125114 is a high-severity vulnerability in novuhq novu, published on 9 Nov 2026.
Official description
Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-125114?
1 open source package ship an affected version, including @novu/api.
| Package | Affected | Fixed in |
|---|---|---|
@novu/api npm | All versions | 3.15.0 |
How do I fix CVE-2026-125114?
Upgrade @novu/api to 3.15.0 or later.
Is CVE-2026-125114 being exploited?
There is no known exploitation of CVE-2026-125114 in the wild and no public exploit code.
Sources
Also known as GHSA-4x48-cgf9-q33f.