# CVE-2026-101088: Nezha race condition in service sentinel worker

Source: https://junglewise.ai/threats/cve-2026-101088-nezha-is-a-server-and-website-monitoring-tool-in-versions-2-2-11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-101088 · Severity: medium · CVSS 5.3 · Published 2026-09-27

Nezha is a server and website monitoring tool that tracks the health and performance of infrastructure. An authenticated member user who owns an agent can trigger a denial of service by concurrently deleting their own server while the monitoring worker is processing service health checks, causing an unrecovered crash that takes down the entire monitoring instance. Versions 2.2.11 through 2.3.0 are affected.

Technologies: [Nezha](https://junglewise.ai/threats/technologies/nezha-nezha). Vendors: [Nezha](https://junglewise.ai/threats/vendors/nezha).

## Quick answers

**Is CVE-2026-101088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101088 being exploited in the wild.

**How severe is CVE-2026-101088?** Medium severity, with a CVSS score of 5.3, published 27 September 2026.

**Which products and versions are affected?** Nezha >=2.2.11, <2.3.1.

**Is there a fix for CVE-2026-101088?** A patch was published on 2026-08-01: fix released in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101088 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-101088?** Check whether you run Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check-time-of-use (TOCTOU) race condition exists in the service sentinel worker (servicesentinel.go). The July 2026 fix for a related nil dereference vulnerability re-validated the service lifecycle under serviceResponseDataStoreLock but reused a stale reporter pointer and never re-validated the server object. An authenticated attacker can win the race window by issuing a concurrent server delete (POST /api/v1/batch-delete/server) for their own server, causing the worker to dereference a missing entry in the server list snapshot. The sentinel workers and gRPC server lack panic recovery handlers, so the resulting panic crashes the entire instance without graceful degradation.

## Affected products

- Nezha Nezha >=2.2.11, <2.3.1

## Timeline

- 2026-09-27: disclosed
- 2026-08-01: patched: fix released in version 2.3.1

## References

- [https://github.com/nezhahq/nezha/security/advisories/GHSA-jx78-55p5-rwv5](https://github.com/nezhahq/nezha/security/advisories/GHSA-jx78-55p5-rwv5)
- [https://www.vulncheck.com/advisories/nezha-before-2.3.1-denial-of-service-via-concurrent-server-delete](https://www.vulncheck.com/advisories/nezha-before-2.3.1-denial-of-service-via-concurrent-server-delete)

## Related threats

- [Nezha dashboard NULL pointer dereference in loadTodayStats](https://junglewise.ai/threats/cve-2026-120046-nezha-2-0-0-before-2-4-0-contains-a-null-pointer-dereference)
- [Nezha information disclosure in server configuration APIs](https://junglewise.ai/threats/cve-2026-111386-nezha-from-1-7-0-before-2-3-15-contains-an-information)
- [Nezha host header injection in file transfer URLs](https://junglewise.ai/threats/cve-2026-111385-nezha-from-2-1-0-before-2-3-15-contains-a-host-header-injection)
- [Nezha resource exhaustion in WebSocket endpoint](https://junglewise.ai/threats/cve-2026-111383-nezha-from-2-0-13-before-2-3-15-contains-a-resource-exhaustion)
- [Nezha lock-order inversion in notification groups](https://junglewise.ai/threats/cve-2026-105112-nezha-from-1-8-0-before-2-3-13-contains-a-lock-order-inversion)