Security advisories

medium2026-09-22

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

GHSA-8gr3-5j6f-25gp · CVE-2026-75510

medium2026-07-28

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

GHSA-vg6v-j97m-h5xq

high2026-04-14

Novu has a XSS sanitization bypass

GHSA-26wg-9xf2-q495

high2026-04-14

Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

GHSA-4x48-cgf9-q33f