Read the docs
TI-2026-83339 Aliases CVE-2026-120046GHSA-9764-g6f6-xvmw

NULL pointer dereference in Nezha dashboard startup via orphaned history

Priority LOW 27CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference in ServiceSentinel.loadTodayStats (CWE-476) that lets an authenticated user crash the dashboard. An attacker with low privileges and network access can delete their own service, which leaves orphaned service history rows that crash the non-TSDB dashboard on its next startup until those rows are removed manually. The impact is limited to availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed nezha (nezhahq): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nezhahqnezha2.0.0 to before 2.4.02.4.0Patch availableCNA
  • nezha Vendornezhahq Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available CNA

Remediation

Upgrade nezha to version 2.4.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA nezha (nezhahq) Fixed in 2.4.0

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-120046
  2. 2026-10-30 Alias added: GHSA-9764-g6f6-xvmw
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed

References

Patch 1

Other 4

  • TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
  • TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
  • TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
  • TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
  • TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
  • TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences