What’s Vulnerable › Vulnerabilities

CVE-2026-105112: Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-03 · updated 2026-10-05
• Weakness: CWE-362

Description

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.

Affected products

• nezhahq nezha: from 1.8.0 before 2.3.13 — fixed in 2.3.13

How to fix

Upgrade to a fixed version: nezhahq nezha 2.3.13. Check the vendor advisory for mitigations.

References

• https://github.com/nezhahq/nezha/security/advisories/GHSA-53vr-p24v-qvwf
• https://www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-deadlock-dos-via-notification-group-endpoints
• https://github.com/nezhahq/nezha/security/advisories/GHSA-53vr-p24v-qvwf

Get alerted when CVE-2026-105112 or the next vulnerability affects your stack