novu vulnerabilities
CVEs whose affected-version data names the novu package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-75511Medium· 5.3Novu provides an API for sending notifications through multiple channels
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event override…
CVE-2026-75517Medium· 6.5Novu provides an API for sending notifications through multiple channels
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary l…
CVE-2026-75510Medium· 5.1PoCNovu provides an API for sending notifications through multiple channels
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and…