ntfy
Alerting & IncidentsA simple HTTP-based pub‑sub service for sending push notifications to phones or desktops without signing up or paying fees
Features
- Send push notifications via plain HTTP PUT/POST requests
- Free public instance at ntfy.sh with no registration required
- Open‑source client apps for Android and iOS (Google Play, F‑Droid, App Store)
- Self‑hostable server to keep data private
Recent releases
View all 15 releases →
v2.22.0
Security relevant
Security fixes
- SSRF vulnerability in web push endpoint allow-list regex (GHSA-w9hq-5jg7-q4j7)
Notable features
- Access tokens can now be set to never expire in web app
- Fixed web app crash on account page for tokens without last access time
Full changelog
Bug fixes + maintenance:
- Tighten web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching (GHSA-w9hq-5jg7-q4j7, thanks to @MightyNawaf for reporting)
- Fix web app not allowing access tokens to be changed to never expire (#1693/#1694, thanks to @lastsamurai26 for reporting and to @ShipItAndPray for fixing)
- Fix web app crashing on account page for tokens without a last access time (#1651, #1684, thanks to @Pulsar7 and @rzhli for reporting)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
About
Stars
32,007
Forks
1,419
Languages
Go
JavaScript
Makefile
Install & Platforms
Mobile
Android
IOS
Community & Support
Tracked by
1
person tracking
People also track
open-webui
1 tracking
immich
1 tracking
Home Assistant
1 tracking
uptime-kuma
1 tracking
vaultwarden
1 tracking
neovim
1 tracking
