An unanchored regular expression in the action parsing routine of ntfy allows a remote attacker to cause the server to issue arbitrary HTTP requests to any URL. This Server‑Side Request Forgery (SSRF) flaw, categorized as a Code Injection weakness (CWE‑94), can expose internal services, credentials, or sensitive data that are otherwise inaccessible from the outside. The flaw does not require authentication and can be triggered by any client that can reach the parseActions endpoint.

All ntfy ntfy.sh installations older than version 2.22.0 are affected. The product is a standalone notification server; no vendor is specified beyond the ntfy project itself.

The CVSS score of 9.8 indicates a critical impact, while the EPSS score of < 1 % shows a low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation is feasible remotely by sending a crafted request to the parseActions endpoint, with no prerequisite authentication. Once triggered, the server will perform arbitrary outbound HTTP requests, potentially accessing internal resources or facilitating further attacks.