Nezha versions >=2.2.11 and <2.3.1 contain a TOCTOU race condition in the service sentinel worker component. The service lifecycle validation uses a lock (serviceResponseDataStoreLock) but reuses a stale reporter pointer and does not guard the ServerShared data structure, allowing a race window. An authenticated member user can issue a concurrent server deletion request to cause the sentinel worker to dereference a missing server entry, leading to an unrecovered panic that crashes the entire Nezha instance. This vulnerability is a result of an incomplete fix for a prior nil dereference denial of service issue (GHSA-qjpp-gffx-2wm9). The vulnerability is resolved in version 2.3.1.

Exploitation requires authenticated access with member role and ownership of an agent. Successful exploitation causes a panic in the sentinel worker due to dereferencing a missing server entry, crashing the entire Nezha instance and resulting in denial of service. There is no indication of code execution or data compromise. The CVSS 4.0 score is 6.0 (medium severity) reflecting the impact of denial of service with high attack complexity and low privileges required.

Upgrade Nezha to version 2.3.1 or later, where this race condition vulnerability is fixed. No other mitigations are indicated. Since the vulnerability requires authenticated access with member role, restricting user privileges may reduce risk but does not eliminate the vulnerability. Patch status is official-fix in 2.3.1.