p PatchFirst

PatchFirst · Latest vulnerabilities

@novu/api vulnerabilities

Vulnerabilities published for @novu/api in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-4x48-cgf9-q33f

    Not ratedFix available

    Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

    ## Summary The conditions filter webhook at `libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts` line 261 sends POST requests to user-configured URLs using raw `axios.post()` with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses `validateUrlSsrf()` which blocks private IP ranges. The conditions webhook was not included in this protection. ## Root Cause `conditions-filter.usecase.ts` line 261: ```typescript return await axios.post(child.webhookUrl, payload, config).then((response) => { return response.data as Record<string, unknown>; }); ``` No call to `validateUrlSs

    @novu/apiNode.js
    • Update to 3.15.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →