# CVE-2026-100394: Nezha monitoring dashboard denial of service via service deletion race

Source: https://junglewise.ai/threats/cve-2026-100394-nezha-monitoring-whole-instance-dos-in-nezha-dashboard-a-member  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-100394 · Severity: medium · CVSS 6.5 · Published 2026-10-14

Nezha is a server monitoring dashboard that tracks service health via agent reports. A low-privilege member can crash the entire dashboard process by creating and deleting services while rapidly sending monitoring data, bringing down the web UI and APIs for all tenants. The attack requires only access to their own services and agents, no administrative privileges.

Technologies: [github.com/nezhahq/nezha (Go)](https://junglewise.ai/threats/technologies/github-com-nezhahq-nezha). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nezha](https://junglewise.ai/threats/vendors/nezha).

## Quick answers

**Is CVE-2026-100394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100394 being exploited in the wild.

**How severe is CVE-2026-100394?** Medium severity, with a CVSS score of 6.5, published 14 October 2026.

**Which products and versions are affected?** github.com/nezhahq/nezha (Go) >= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d, SEMVER:introduced=0.0.0-20260628010923-fd31e5f1b0f8,fixed=0.0.0-20260721131105-c893aa57867d; Nezha monitoring dashboard v2.2.7 through v2.2.10.

**Is there a fix for CVE-2026-100394?** Yes. github.com/nezhahq/nezha (Go): upgrade to 0.0.0-20260721131105-c893aa57867d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100394 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-100394?** Check whether you run github.com/nezhahq/nezha (Go) or Nezha monitoring dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nezhahq/nezha (Go): upgrade to 0.0.0-20260721131105-c893aa57867d or later

  ```sh
  go get github.com/nezhahq/nezha@v0.0.0-20260721131105-c893aa57867d
  ```


## Technical details

A nil pointer dereference in the service-monitor worker (servicesentinel.go:601) occurs due to a cross-lock TOCTOU between the check-and-use of service status maps. The worker validates service existence under servicesLock, then writes to status maps under serviceResponseDataStoreLock at a later point; a concurrent delete removes map entries in the gap between these two locks. Since the gRPC server lacks a recovery interceptor, the panic in the worker goroutine terminates the entire process. Attack preconditions: member authentication via agent credentials, ability to create/delete own services, and sending ping results over gRPC.

## Affected products

- Nezha Nezha monitoring dashboard v2.2.7 through v2.2.10

## Identifiers

- CVE-2026-100394
- GHSA-qjpp-gffx-2wm9
- GO-2026-6794

## Timeline

- 2026-10-15: disclosed

## Related threats

- [Nezha Host header injection in OAuth2 redirect endpoint](https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the)
- [Nezha OAuth2 redirect_uri Host header injection regression](https://junglewise.ai/threats/nezha-oauth2-redirect-uri-host-header-injection-regression-331e924a)
- [Nezha Monitoring insufficient stream authorization in websocket endpoints](https://junglewise.ai/threats/cve-2026-62283-nezha-monitoring-insufficient-stream-authorization-in-websocket)
- [Nezha Monitoring plaintext credential exposure in DDNS and Notification APIs](https://junglewise.ai/threats/cve-2026-59155-nezha-monitoring-plaintext-credential-exposure-in-ddns-and)
- [Nezha Monitoring Host Header Injection in OAuth2 callback](https://junglewise.ai/threats/cve-2026-53523-nezha-monitoring-host-header-injection-in-oauth2-callback)