Medium severity · published Oct 16, 2026
CVE-2026-111384
Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nezha · nezhahq
1.0.0 before 2.3.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111384
github.com
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
github.com
https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9
www.vulncheck.com
https://www.vulncheck.com/advisories/nezha-1.0.0-before-2.3.15-memory-exhaustion-via-file-manager-websocket
More from nezha
9.9
CVE-2026-62283
Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
9.9
CVE-2026-46716
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
9.8
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
9.1
CVE-2026-53519
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
7.7
CVE-2026-46717
Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification