{"id":"CVE-2026-111384","kind":"vulnerability","aliases":["CVE-2026-111384"],"related":[],"title":"Nezha dashboard: unbounded WebSocket message lets file manager users crash monitoring","description":"Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.","summary":"Nezha 1.0.0 before 2.3.15 has a file manager WebSocket endpoint that never limits incoming message size. An authenticated user with file manager permissions can send one oversized binary message and exhaust memory, causing the dashboard to be killed and all agent monitoring to drop.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","monitoring","nezha","other","self-hosted"],"not_affected_if":["no-file-manager-users","version-2.3.15-or-later"],"how_to_check":"- Check the installed Nezha dashboard version; it is affected if it is between `1.0.0` and `2.3.14` inclusive.\n- unknown whether a configuration check exists beyond the version.","fix":"- Upgrade the Nezha dashboard to `2.3.15` or later.\n- Restrict file manager permissions to trusted users until upgraded.","status":"open","published_at":"2026-10-16T03:18:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:36:48+00:00","updated_at":"2026-10-25T03:36:48+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:36:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Nezha dashboard to `2.3.15` or later.\n- Restrict file manager permissions to trusted users until upgraded.","reach":"network","title":"Nezha dashboard: unbounded WebSocket message lets file manager users crash monitoring","impact":"medium","summary":"Nezha 1.0.0 before 2.3.15 has a file manager WebSocket endpoint that never limits incoming message size. An authenticated user with file manager permissions can send one oversized binary message and exhaust memory, causing the dashboard to be killed and all agent monitoring to drop.","category":"other","nicknames":[],"who_cares":["nezha","self-hosted","monitoring","go"],"confidence":0.8,"needs_auth":"yes","worst_case":"Dashboard process crashes from memory exhaustion, dropping all agent monitoring","analyst_note":"Confirm whether the file manager is enabled by default and whether any config option disables it; check the NVD entry and the upstream fix commit for details.","how_to_check":"- Check the installed Nezha dashboard version; it is affected if it is between `1.0.0` and `2.3.14` inclusive.\n- unknown whether a configuration check exists beyond the version.","needs_analyst":true,"not_affected_if":["version-2.3.15-or-later","no-file-manager-users"],"who_is_affected":"Teams that self-host the Nezha dashboard with the file manager feature available to some users. Exposure requires an account holding file manager scopes, so instances where only administrators log in carry lower risk. Users of hosted monitoring services that do not run Nezha themselves can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3363,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111384':14A,17A '-2026':13A,16A '/api/v1/ws/file':107C '1.0.0':26B,70C '2.3.15':28B,72C 'agent':65B,116C 'authent':42B,94C 'binari':52B,104C 'call':88C 'caus':57B 'contain':73C 'crash':10A 'cve':12A,15A 'dashboard':2A,59B,80C 'drop':68B,114C 'endpoint':34B,84C 'exhaust':55B,76C 'file':7A,31B,45B,81C,97C 'fmstream':86C 'go':18B 'host':24B 'id':108C 'incom':38B 'kill':62B,112C 'leav':90C 'let':6A 'limit':37B 'manag':8A,32B,46B,82C,98C 'memori':56B,75C 'messag':5A,39B,53B,91C,105C 'monitor':11A,19B,66B,117C 'never':36B,87C 'nezha':1A,20B,25B,69C 'one':50B,102C 'oom':111C 'overs':51B,103C 'permiss':47B 'scope':99C 'self':23B 'self-host':22B 'send':49B,101C 'setreadlimit':89C 'size':40B,92C 'trigger':109C 'unbound':3A,93C 'user':9A,43B,95C 'vulner':77C 'websocket':4A,33B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host the Nezha dashboard with the file manager feature available to some users. Exposure requires an account holding file manager scopes, so instances where only administrators log in carry lower risk. Users of hosted monitoring services that do not run Nezha themselves can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111384","severity":null,"published_at":"2026-10-16T03:18:05+00:00","modified_at":"2026-10-23T20:17:20+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}