CVE-2026-75510: Novu Stored XSS Vulnerability via Notification Redirect URL
Summary
CVE-2026-75510: Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme. Affects @novu/js versions < 3.18.0. Fixed in 3.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Novu is an open-source notification infrastructure that allows developers to manage notifications across various channels. It provides features like in-app messaging, email notifications, and more. The vulnerability in question arises from the way the In-App Inbox renderer handles notification redirect URLs, specifically allowing JavaScript execution through improperly validated URLs.
Vulnerability Detail
The vulnerability stems from the @novu/js In-App Inbox renderer, which passes a notification's redirect.url to window.open() without validating the URL scheme. This allows an authenticated user to create a workflow that includes a javascript: URL, leading to stored cross-site scripting (XSS). When a recipient clicks on the notification, the malicious JavaScript executes in the context of the recipient's browser, potentially leading to session hijacking or other malicious actions.
How To Fix
Minimum fixed version
3.18.0
This is the first release that contains the fix.
npm install @novu/js@3.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the In-App Inbox feature until the package is updated. Additionally, ensure that any workflows created do not include javascript: URLs in the redirect.url field.
Conclusion
CVE-2026-75510 presents a significant security risk for users of the Novu notification system, particularly those utilizing the In-App Inbox feature. It is crucial to update to the patched version to mitigate the risk of stored XSS attacks. Users should also consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for @novu/js →
FAQ
CVE-2026-75510 is a vulnerability in the Novu notification system that allows for stored cross-site scripting (XSS) through improperly validated notification redirect URLs.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include the potential for session hijacking, unauthorized actions in the context of the user's session, and the ability to execute arbitrary JavaScript in the user's browser.
Any users of Novu versions up to 3.15.0, specifically those using the In-App Inbox feature, are at risk if they are using a Chromium-based browser.
If you cannot update the package immediately, refrain from using the In-App Inbox feature and ensure that no workflows include javascript: URLs.
