← All advisories

Critical severity9.8NVD Advisory· Published Apr 23, 2026· Updated May 4, 2026

CVE-2026-39087

CVE-2026-39087

Description

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
heckel.io/ntfy/v2Go	< 2.22.0	2.22.0

Affected products

2

Binwiederhier/Ntfyreferences
ghsa-coords
pkg:golang/heckel.io/ntfy/v2
Range: < 2.22.0

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-pqhx-w72w-m393ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-39087ghsaADVISORY
ntfy.comnvdWEB
ntfysh.comnvdWEB
gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5nvdWEB
github.com/binwiederhier/ntfy/releases/tag/v2.22.0nvdWEB

News mentions

0

No linked articles in our index yet.