What’s Vulnerable › Vulnerabilities

CVE-2026-111384: Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-23
• Weakness: CWE-770

Description

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

Affected products

• nezhahq nezha: from 1.0.0 before 2.3.15 — fixed in 2.3.15

How to fix

Upgrade to a fixed version: nezhahq nezha 2.3.15. Check the vendor advisory for mitigations.

References

• https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
• https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9
• https://www.vulncheck.com/advisories/nezha-1.0.0-before-2.3.15-memory-exhaustion-via-file-manager-websocket
• https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9

Get alerted when CVE-2026-111384 or the next vulnerability affects your stack