CVE-2026-120046: Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

Q: Who can trigger the dashboard crash?

An authenticated user with the ability to delete their own service can trigger it by using POST /api/v1/batch-delete/service. No user interaction is required.

Q: Which deployments are affected?

The issue affects Nezha versions from 2.0.0 before 2.4.0 when using the non-TSDB dashboard. The crash occurs when that dashboard starts and encounters orphaned service_histories rows.

Q: What can be done if upgrading is not immediately possible?

Remove the orphaned service_histories rows created after service deletion before restarting the non-TSDB dashboard. This prevents the startup NULL pointer dereference until an upgrade is possible.

Q: How can administrators tell whether they are already affected?

A vulnerable non-TSDB dashboard will crash on startup if orphaned service_histories records exist for deleted services. Review whether services were deleted through the batch-delete endpoint and whether related history rows remain.

Published Oct 30, 2026

Updated

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned servicehistories rows that crash the non-TSDB dashboard on its next startup until removed manually.

Affected Software

1 affected component

Nezha Nezha>=2.0.0<2.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nezha to a version that resolves this vulnerability.
Fixed in 2.4.0
Operational
Manually remove orphaned service_histories rows to restore the non-TSDB dashboard after an affected service deletion.

Event History

Oct 30, 2026

CVE Published

via MITRE·06:52 PM

Data Sourced

via MITRE·06:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the dashboard crash?

An authenticated user with the ability to delete their own service can trigger it by using POST /api/v1/batch-delete/service. No user interaction is required.

Which deployments are affected?

The issue affects Nezha versions from 2.0.0 before 2.4.0 when using the non-TSDB dashboard. The crash occurs when that dashboard starts and encounters orphaned service_histories rows.

What can be done if upgrading is not immediately possible?

Remove the orphaned service_histories rows created after service deletion before restarting the non-TSDB dashboard. This prevents the startup NULL pointer dereference until an upgrade is possible.

How can administrators tell whether they are already affected?

A vulnerable non-TSDB dashboard will crash on startup if orphaned service_histories records exist for deleted services. Review whether services were deleted through the batch-delete endpoint and whether related history rows remain.

CVE-2026-120046: Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can trigger the dashboard crash?

Which deployments are affected?

What can be done if upgrading is not immediately possible?

How can administrators tell whether they are already affected?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the dashboard crash?

Which deployments are affected?

What can be done if upgrading is not immediately possible?

How can administrators tell whether they are already affected?