CVE-2026-39087

6.4 mediumEPSS 0.3%

Medium (6.4). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in heckel.io/ntfy/v2 2.22.0.

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Severity

6.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWEs: CWE-777, CWE-94
Published: 2026-04-23
Modified: 2026-07-04
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-pqhx-w72w-m393	Go	heckel.io/ntfy/v2	<2.22.0	2.22.0
GO-2026-5551	Go	heckel.io/ntfy	all versions	no fix published
GO-2026-5551	Go	heckel.io/ntfy/v2	<2.22.0	2.22.0