npm/@novu/api: high

Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

Action: Upgrade @novu/api to 3.15.0 or later.

npm i @novu/api@3.15.0

Affected

Fixed versions

Sources

• osv: GHSA-4x48-cgf9-q33f
• https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f
• https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68
• https://github.com/novuhq/novu

published 2026-04-14T23:22:48Z · modified 2026-04-14T23:36:08.575651Z · JSON