CVE-2026-111384: Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
Published Oct 16, 2026
·Updated
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
Affected Software
1 affected component
Nezha Nezha>=1.0.0<2.3.15
Event History
Oct 16, 2026
CVE Published
via MITRE·01:17 AM
Data Sourced
via MITRE·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
An attacker must be authenticated and have file manager scopes. They can exploit the dashboard file manager WebSocket endpoint by sending a single oversized binary message.
2
What systems are affected?
Nezha versions from 1.0.0 before 2.3.15 are affected. The impacted endpoint is /api/v1/ws/file/:id.
3
What is the operational impact of successful exploitation?
A successful oversized message can exhaust memory and trigger an OOM kill. This drops monitoring for all agents.