Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/nezhahq/nezha

17 known vulnerabilities (4 critical, 4 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release
v1.14.14 (Jan 10, 2026): affected by 16 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
17 · 4 critical, 4 high, 9 medium
Releases
131 since v1.0.0 (Nov 28, 2024)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-100394Medium 6.5

    Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

    Affected: from 0.0.0-20260628010923-fd31e5f1b0f8, fixed in 0.0.0-20260721131105-c893aa57867d.

    Fixed in v1.0.0 (released Nov 28, 2024, 685 days before disclosure, the advisory names 0.0.0-20260721131105-c893aa57867d, which was never published).

    The latest release, v1.14.14, is not affected.

  • CVE-2026-101090Critical 9.3

    Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

    Affected: versions 2.2.3; all versions.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-62283Critical 9.9

    Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

    Affected: from 1.14.13, through 1.14.14; from 2.0.0, fixed in 2.0.10; all versions; from 1.14.13.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-59155Medium 6.9

    Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

    Affected: fixed in 2.2.5; all versions.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-53523Medium 6.8

    Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

    Affected: from 1.0.0, fixed in 2.2.0; from 1.0.0.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-53522Medium 6.5

    Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

    Affected: from 1.0.0, fixed in 2.2.0; from 1.0.0.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-53521Medium 6.4

    Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

    Affected: from 2.0.14, fixed in 2.1.0; all versions.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-53520Medium 6.5

    Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

    Affected: all versions; from 2.0.14, fixed in 2.1.0.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-53519Critical 9.1

    Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

    Affected: fixed in 2.0.13; all versions.

    No fix released. The latest release, v1.14.14, is still affected.

  • CVE-2026-49397Medium 5.3

    Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data

    Affected: all versions; from 2.0.0, fixed in 2.0.14.

    No fix released. The latest release, v1.14.14, is still affected.

  • Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents

    Affected: from 1.0.0; from 1.0.0, fixed in 2.0.14.

    No fix released. The latest release, v1.14.14, is still affected.

  • Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services

    Affected: from 1.0.0, fixed in 1.14.15-0.20260521020202-02129f16fb15; from 0.20.0, fixed in 1.14.15-0.20260521020202-02129f16fb15; from 2.0.0, fixed in 2.0.12.

    No fix released. The advisory names 1.14.15-0.20260521020202-02129f16fb15 and 2.0.12 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.

  • CVE-2026-47124Medium 6.5

    Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

    Affected: from 1.4.0, fixed in 1.14.15-0.20260517034128-05e5da253519.

    No fix released. The advisory names 1.14.15-0.20260517034128-05e5da253519 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.

  • Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

    Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d7526351cf97.

    No fix released. The advisory names 1.14.15-0.20260517022419-d7526351cf97 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.

  • Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

    Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d06d539d34c1.

    No fix released. The advisory names 1.14.15-0.20260517022419-d06d539d34c1 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.

Show all 17 advisoriesShow fewer advisories
  • CVE-2026-46716Critical 9.9

    Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

    Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d7526351cf97.

    No fix released. The advisory names 1.14.15-0.20260517022419-d7526351cf97 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.

  • CVE-2026-47268Medium 6.4

    Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host

    Affected: from 0.20.0, fixed in 2.0.10.

    No fix released. The advisory names 2.0.10 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected.