Cloudanix VulnDB

CVE-2026-39087

Medium · 6.4

CVSS

6.4

EPSS

0.5%

Published

Apr 23, 2026

CISA due date

—

The record

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities