What’s Vulnerable › Products

nezhahq nezha vulnerabilities

30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.

Check whether your nezhahq nezha version is affected

Latest nezhahq nezha vulnerabilities

• CVE-2026-120046 — Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History (CVSS 5.3)
• CVE-2026-111387 — Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint (CVSS 6.5)
• CVE-2026-111386 — Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig (CVSS 4.3)
• CVE-2026-111385 — Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools (CVSS 4.8)
• CVE-2026-111384 — Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket (CVSS 6.5)
• CVE-2026-111383 — Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket (CVSS 6.5)
• CVE-2026-100394 — Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (CVSS 6.5)
• CVE-2026-105113 — Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock (CVSS 6.5)
• CVE-2026-105112 — Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints (CVSS 5.3)
• CVE-2026-101090 — Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri (CVSS 9.8)
• CVE-2026-101089 — Nezha before 2.2.7 Information Disclosure via /api/v1/profile (CVSS 3.1)
• CVE-2026-101088 — Nezha before 2.3.1 Denial of Service via Concurrent Server Delete (CVSS 5.3)
• CVE-2026-101087 — Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 (CVSS 4.3)
• CVE-2026-101086 — Nezha Dashboard before 2.3.5 Task Type Validation Bypass (CVSS 6.5)
• CVE-2026-101085 — Nezha before 2.3.8 Denial of Service via Alert Rule (CVSS 6.5)
• CVE-2026-62283 — Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check (CVSS 9.9)
• CVE-2026-59155 — Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API (CVSS 6.9)
• CVE-2026-53523 — Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection (CVSS 6.8)
• CVE-2026-53522 — Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS (CVSS 6.5)
• CVE-2026-53521 — Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context (CVSS 6.4)
• CVE-2026-53520 — Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing (CVSS 6.5)
• CVE-2026-53519 — Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key (CVSS 9.1)
• CVE-2026-49397 — Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data (CVSS 5.3)
• CVE-2026-49396 — Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents (CVSS 7.1)
• CVE-2026-48119 — Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services (CVSS 7.1)