Live › vulnerability › CVE-2026-111384
Go to dashboardNezha 1.0.0 before 2.3.15 has a file manager WebSocket endpoint that never limits incoming message size. An authenticated user with file manager permissions can send one oversized binary message and exhaust memory, causing the dashboard to be killed and all agent monitoring to drop.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host the Nezha dashboard with the file manager feature available to some users. Exposure requires an account holding file manager scopes, so instances where only administrators log in carry lower risk. Users of hosted monitoring services that do not run Nezha themselves can skip it.
No product ranges from the sources yet.
1.0.0 and 2.3.14 inclusive.2.3.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
This page as .md · .json · in your agent: get_signal("CVE-2026-111384")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.