Executive brief
Nezha Monitoring is a dashboard used to monitor and manage remote servers. A vulnerability in its terminal and file management features allows an authenticated user to open an unlimited number of connections. This can be used to crash the monitoring dashboard or the remote servers being monitored by exhausting their memory and processing power, leading to a complete loss of monitoring capabilities.
Technical details
The Nezha dashboard contains a resource exhaustion vulnerability in the `createTerminal` and `createFM` endpoints. These endpoints call `CreateStreamWithPurpose`, which inserts new stream contexts into an unbounded Go map without per-user rate limiting or global connection caps. Each stream triggers the allocation of goroutines, channels, and 1MB I/O buffers on the dashboard, while also spawning PTY/shell processes on the monitored agents via gRPC. An authenticated attacker with standard server execution or file management permissions can programmatically open thousands of streams to exhaust dashboard memory and agent resources. The issue is fixed in version 2.2.0 by implementing concurrency controls and stream limits.
Affected products
- nezhahq nezha >= 1.0.0, < 2.2.0
Timeline
- 2026-06-05: disclosed: Initial publication by nezhahq
- 2026-06-12: advisory: NVD publication
- 2026-06-26: patched: GitHub Advisory Database entry updated with patch information