CVE-2026-39087CWE-777

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs

Medium · published April 23, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-777 · Regular Expression without Anchors
Published
2026-04-23T00:00Z
EPSS history
Timeline
  • 23 APR 00:00Z
    ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs
    cvelistv5