CVE-2026-39087

MEDIUM

ntfy < 2.22.0 - Server-Side Request Forgery

Title source: manual

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Core 5

Core References

http://ntfy.com

https://ntfy.sh

CVSS v3 6.4

EPSS 0.0027

EPSS Percentile 19.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

CWE

CWE-777 CWE-94

Status published

Products (2)

ntfy/ntfy < 2.22.0

ntfy/v2 0 - 2.22.0Go

Published Apr 23, 2026

Tracked Since Apr 23, 2026