---
id: "CVE-2026-111384"
kind: "vulnerability"
aliases: ["CVE-2026-111384"]
title: "Nezha dashboard: unbounded WebSocket message lets file manager users crash monitoring"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["go", "monitoring", "nezha", "other", "self-hosted"]
not_affected_if: ["no-file-manager-users", "version-2.3.15-or-later"]
published_at: "2026-10-16T03:18:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:36:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111384", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Nezha dashboard: unbounded WebSocket message lets file manager users crash monitoring

Nezha 1.0.0 before 2.3.15 has a file manager WebSocket endpoint that never limits incoming message size. An authenticated user with file manager permissions can send one oversized binary message and exhaust memory, causing the dashboard to be killed and all agent monitoring to drop.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nezha dashboard version; it is affected if it is between `1.0.0` and `2.3.14` inclusive.
- unknown whether a configuration check exists beyond the version.

## Fix

- Upgrade the Nezha dashboard to `2.3.15` or later.
- Restrict file manager permissions to trusted users until upgraded.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111384

## From the sources

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_