Threats tagged 'ghsa-vg6v-j97m-h5xq'

The @novu/application-generic package contains a server-side request forgery (SSRF) protection function called validateUrlSsrf that fails to block the 100.64.0.0/10 shared address space (CGNAT). This omission allows server-side requests to potentially sensitive internal or cloud provider metadata services, such as Alibaba Cloud's metadata endpoint at 100.100.100.200. The vulnerability affects versions prior to 3.17.0 and has been fixed in version 3.17.0.