This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
ReleasePort's take
Moderate signalThe release hard‑caps execution timeout on message templates to stop CPU denial‑of‑service attacks and strips unsafe URL protocols from Markdown links/images.
Why it matters: Hard‑capping template execution prevents DoS (severity 90) and removing unsafe protocols mitigates injection risks; both changes are live in v2.26.0.
Summary
AI summaryUpdates https://github.com/binwiederhier/ntfy/pull/1826, https://github.com/binwiederhier/ntfy/issues/1647, and https://github.com/binwiederhier/ntfy/issues/1727 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Hard‑caps execution timeout on message templates, preventing CPU denial‑of‑service. Hard‑caps execution timeout on message templates, preventing CPU denial‑of‑service. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Adds configurable date and time format settings in the web app. Adds configurable date and time format settings in the web app. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Strips unsafe URL protocols from Markdown‑rendered links and images in the web app. Strips unsafe URL protocols from Markdown‑rendered links and images in the web app. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
`GET /account` now reads from the primary database to avoid stale data after changes. `GET /account` now reads from the primary database to avoid stale data after changes. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes
a denial-of-service hole.
On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience,
and a fix that strips unsafe URL protocols from rendered Markdown.
Security:
- Prevent a CPU denial of service via message templates (
Template: yes), #1826, thanks to @alanturing881 for reporting)
Features:
- Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account (#1647, thanks to @wsw70 for reporting)
Bug fixes + maintenance:
- Web app: Smooth transitions and loading animation, remove flickering
- Web app:
GET /accountnow reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind - Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option (#1727, thanks to @mberlofa)
- Web app: Strip unsafe URL protocols (
javascript:,data:, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to @jvoisin for reporting)
Security Fixes
- Prevent CPU denial of service via message templates (Template: yes) – closes CVE‑like vulnerability, #1826
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]