critical9.8
CVE-2026-39087
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
Impact
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | heckel.io/ntfy/v2 | < 2.22.0 | 2.22.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-pqhx-w72w-m393
- https://nvd.nist.gov/vuln/detail/CVE-2026-39087
- https://gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5
- http://ntfy.com
- http://ntfysh.com
- https://github.com/binwiederhier/ntfy/releases/tag/v2.22.0
- https://ntfy.sh