Is CVE-2026-105113 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105113 being exploited in the wild.

How severe is CVE-2026-105113?

Medium severity, with a CVSS score of 6.5, published 3 October 2026.

Which products and versions are affected?

Nezha Dashboard 1.8.0 before 2.3.13.

Is there a fix for CVE-2026-105113?

Yes: fixed in 2.3.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105113 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105113?

Check whether you run Nezha Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105113: Nezha Dashboard improper locking in notification subsystem

CVE-2026-105113 · Severity: medium · CVSS 6.5 · Published 2026-10-03

Nezha Dashboard is a server monitoring and alerting platform. An authenticated non-administrator user can trigger a deadlock in the notification system with just four API calls, permanently disabling all alert delivery across the entire system. The attacker can then exhaust memory by issuing requests that block indefinitely, causing a silent failure where alerts stop being sent despite the process remaining running.

Vendors: Nezha.

Quick answers

Is CVE-2026-105113 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105113 being exploited in the wild.
How severe is CVE-2026-105113?: Medium severity, with a CVSS score of 6.5, published 3 October 2026.
Which products and versions are affected?: Nezha Dashboard 1.8.0 before 2.3.13.
Is there a fix for CVE-2026-105113?: Yes: fixed in 2.3.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105113 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105113?: Check whether you run Nezha Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.13

Technical details

A missing defer statement on a mutex unlock in the notification subsystem causes the mutex to leak when a nil-map panic occurs. An authenticated non-admin member (RoleMember) can manipulate notification group indices through ordinary API calls to trigger this panic path, permanently deadlocking the listMu mutex. All operations guarded by this mutex then block forever, halting notification delivery and enabling memory exhaustion through blocking requests that never complete.

Affected products

Nezha Dashboard 1.8.0 before 2.3.13

Timeline

2026-09-19: disclosed
2026-10-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.