Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

novuhq/novu

              next @ 6b34fff
            

124

Fixes

CVEs

CRITICAL

Peak severity

22.9%

Coverage

Highlights

Auth Bypass: 49 prior fixes. Scrutinize any change in this area.

libs/application-generic/src/services/sanitize/sanitizer.service.ts: most-fixed (7 issues). Treat as high-risk during review.

76 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical logical flaw in API key verification where environment IDs were matched directly as keys instead of searching the designated apiKey database field. This created an immediate mechanism to bypass primary authentication.

SSRF: Outbound requests targeting user-supplied bridge or webhook URLs repeatedly failed to filter private, shared, loopback, or robustly encoded IPv6 subnet addresses, opening up internal microservices to SSRF.

Broken Access Control: Generic repository queries (findOne, update, delete) failed to systematically enforce organizationId and environmentId scoping, enabling cross-tenant/cross-environment data leakage.