Threats affecting pkg:golang/github.com/nezhahq/nezha

Nezha versions from 2.0.13 up to but not including 2.3.15 have a resource exhaustion vulnerability. Authenticated users can open unlimited concurrent WebSocket connections to the /api/v1/ws/transfer endpoint, causing exhaustion of file descriptors, memory, and goroutines. This can block agent gRPC reconnections and degrade service availability.

A race condition vulnerability in Nezha Monitoring versions 2.2.7 through 2.2.10 allows a RoleMember to cause a nil pointer dereference in the ServiceSentinel worker. This leads to a panic that terminates the dashboard process, disrupting the web interface, REST API, and agent connections for all tenants. The issue affects availability only and does not expose or modify data. Fixed in version 2.2.11 and later.

CVE-2026-101088 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the nezha monitoring tool versions >=2.2.11 and <2.3.1. An authenticated user with member role can trigger a concurrent server deletion to cause a panic in the sentinel worker, crashing the entire instance. This occurs because of an incomplete fix that reuses a stale pointer without proper re-validation under locking. The issue is fixed in version 2.3.1.

Nezha versions 2.0.10 through 2.3.2 contain a server-side request forgery (SSRF) vulnerability due to incomplete denylist coverage of IPv6 transition ranges in the HTTP client used for validating user-configurable webhook URLs. Authenticated users can exploit this to cause the dashboard to send requests to certain IPv6 endpoints that are normally restricted. The vulnerability is fixed in version 2.3.3 by blocking the problematic IPv6 prefixes.

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.