Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

Description

The conditions filter webhook at libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts line 261 sends POST requests to user-configured URLs using raw axios.post() with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses validateUrlSsrf() which blocks private IP ranges.

Recommendation

Update the @novu/api package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.15.0
• Patched version(s): 3.15.0

References

• GHSA-4x48-cgf9-q33f
• CWE-918
• OWASP 2021-A10

Related Issues

• Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections - Vulnerability
• PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled - Vulnerability
• LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
• Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@novu/api