ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.Referenceshttps://gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5https://github.com/binwiederhier/ntfy/releases/tag/v2.22.0https://ntfy.sh
