CVE-2026-39087

Description

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Affected Platforms

Weakness Type

CWE-777, CWE-94

References

• https://gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5
• https://github.com/binwiederhier/ntfy/releases/tag/v2.22.0
• https://ntfy.sh