# CVE-2026-111384: Nezha dashboard file manager WebSocket memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-111384-nezha-1-0-0-before-2-3-15-contains-a-memory-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111384 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Nezha is a server monitoring dashboard that collects metrics from distributed agents. An authenticated user with file manager access can send a single oversized message to the file manager WebSocket endpoint, exhausting the dashboard's memory and crashing it, which stops all monitoring and alerting until the service restarts.

Technologies: [NezhaHQ Nezha](https://junglewise.ai/threats/technologies/nezha). Vendors: [NezhaHQ](https://junglewise.ai/threats/vendors/nezhahq).

## Quick answers

**Is CVE-2026-111384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111384 being exploited in the wild.

**How severe is CVE-2026-111384?** Medium severity, with a CVSS score of 6.5, published 16 October 2026.

**Which products and versions are affected?** NezhaHQ Nezha 1.0.0 before 2.3.15.

**Is there a fix for CVE-2026-111384?** Yes: fixed in 2.3.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111384 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-111384?** Check whether you run NezhaHQ Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.15

## Technical details

The fmStream WebSocket handler in cmd/dashboard/controller/fm.go upgrades a connection without calling SetReadLimit, allowing gorilla/websocket to read an entire attacker-supplied message into memory unbounded. An authenticated user with server:read, server:write, and server:delete scopes can send a single binary WebSocket frame of arbitrary size to /api/v1/ws/file/:sessionID, triggering an out-of-memory kill. The parallel terminalStream endpoint has the same upgrade but correctly calls SetReadLimit(terminalWebSocketInputLimit), showing this is a missed security boundary.

## Affected products

- nezhahq Nezha 1.0.0 before 2.3.15

## Timeline

- 2026-10-01: patched: Fixed in commit 36b742a7
- 2026-10-01: advisory: GitHub Security Advisory GHSA-7242-982f-83p9 published
- 2026-10-16: disclosed

## References

- [https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f](https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f)
- [https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9](https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9)

## Related threats

- [Nezha information disclosure in DDNS API](https://junglewise.ai/threats/cve-2026-111387-nezha-from-2-2-5-before-2-3-15-contains-an-information)
- [Nezha Monitoring resource exhaustion via unbounded WebSocket streams](https://junglewise.ai/threats/cve-2026-53522-nezha-monitoring-resource-exhaustion-via-unbounded-websocket)
- [Nezha Monitoring Information Disclosure in Service Endpoints](https://junglewise.ai/threats/cve-2026-49397-nezha-monitoring-information-disclosure-in-service-endpoints)
- [Nezha Monitoring CSRF in cron manual-trigger endpoint](https://junglewise.ai/threats/cve-2026-49396-nezha-monitoring-csrf-in-cron-manual-trigger-endpoint)
- [Nezha Monitoring authorization bypass in service-monitor result worker](https://junglewise.ai/threats/cve-2026-48119-nezha-monitoring-authorization-bypass-in-service-monitor-result)