CVE-2026-111384
CVE-2026-111384 · Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
CVSS 7.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
nezha
- Versions
- ≥ 1.0.0, < 2.3.15: Affected (semver)
- 2.3.15: Not affected (semver)
Update to 2.3.15
Original sources
- https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9
- https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
- https://www.vulncheck.com/advisories/nezha-1.0.0-before-2.3.15-memory-exhaustion-via-file-manager-websocket
- https://nvd.nist.gov/vuln/detail/CVE-2026-111384