{"action":"Upgrade @novu/application-generic to 3.17.0 or later.","affected":[{"fixed":"3.17.0","introduced":"0"}],"component":"@novu/application-generic","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["3.17.0"],"ghsa_id":"GHSA-vg6v-j97m-h5xq","id":"tcs_01M5KGBT097ZSABNHX34JER12P","modified_at":"2026-07-28T15:15:32.607350755Z","published_at":"2026-07-28T14:59:22Z","references":["https://osv.dev/vulnerability/GHSA-vg6v-j97m-h5xq","https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq","https://github.com/novuhq/novu"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-vg6v-j97m-h5xq","url":"https://osv.dev/vulnerability/GHSA-vg6v-j97m-h5xq"}],"summary":"@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition"}