Threats affecting pkg:golang/nezha

Nezha versions 2.0.0 up to but not including 2.4.0 contain a NULL pointer dereference vulnerability in the ServiceSentinel.loadTodayStats function. Authenticated users can exploit this by deleting their own service via the API endpoint POST /api/v1/batch-delete/service, which leaves orphaned service_histories rows. These orphaned rows cause the non-TSDB dashboard to crash on its next startup until the data is manually cleaned. This issue is fixed in version 2.4.0.

Nezha versions from 2.1.0 up to but not including 2.3.15 contain a host header injection vulnerability in the mintTransferTool component. This vulnerability allows attackers who can control the Host header in a victim's MCP request to manipulate file upload and download URLs. Exploitation could enable redirection of file uploads or capture and replay of one-time download tokens to exfiltrate files. The vulnerability has a medium severity with a CVSS 4.0 score of 6.3.

Nezha versions 1.0.0 up to but not including 2.3.15 have a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint. This occurs because the fmStream component does not set a read limit on incoming messages, allowing authenticated users with file manager permissions to send an oversized binary message. Exploiting this can cause an out-of-memory (OOM) kill, which disrupts agent monitoring.