← All advisories

Medium severity6.4NVD Advisory· Published Apr 23, 2026· Updated Jul 4, 2026

CVE-2026-39087

CVE-2026-39087

Description

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
heckel.io/ntfy/v2Go	< 2.22.0	2.22.0

Affected products

3

Binwiederhier/Ntfyreferences
ghsa-coords2 versions
pkg:golang/heckel.io/ntfy/v2 pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 2.22.0+ 1 more
- (no CPE)range: < 2.22.0
- (no CPE)range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

7

github.com/advisories/GHSA-pqhx-w72w-m393ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-39087ghsaADVISORY
ntfy.comghsaWEB
ntfysh.comghsaWEB
gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5nvdWEB
github.com/binwiederhier/ntfy/releases/tag/v2.22.0nvdWEB
ntfy.shnvd

News mentions

0

No linked articles in our index yet.