ntfy before version 2.22.0 exposes a server‑side request forgery vulnerability due to an unanchored regular expression that validates web push endpoint URLs. Because the regex fails to anchor the protocol component, the server incorrectly accepts malformed URLs, allowing an attacker to craft requests that cause ntfy to resolve and request arbitrary internal or external hosts. The flaw embodies CWE‑777 (Unrestricted Input) and also raises a CWE‑94 (Improper Control of Generation of Code) risk by potentially generating unintended code paths based on parsed input.

All installations of ntfy versions older than 2.22.0 are impacted. This open‑source notification server is distributed under the ntfy project brand.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1 % suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could send a crafted HTTP request containing an invalid push endpoint URL that triggers the server to issue outbound requests to arbitrary hosts. Authentication or network restrictions may influence the exact scope of the attack, but the SSRF vector remains possible within trusted networks if the server is publicly reachable.