{"items":[{"id":"NVI-00012120","kind":"vulnerability","title":"Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qjpp-gffx-2wm9","CVE-2026-100394"],"plain_summary":"GitHub lists this reviewed advisory for github.com/nezhahq/nezha. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-ad45c95e0262e0568cca6031d7b6127f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-15T20:15:07.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-ad45c95e0262e0568cca6031d7b6127f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ad45c95e0262e0568cca6031d7b6127f","url":"https://github.com/advisories/GHSA-qjpp-gffx-2wm9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qjpp-gffx-2wm9","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:22.124Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ad45c95e0262e0568cca6031d7b6127f"],"technology":"github.com/nezhahq/nezha","known_exclusions":[],"conditions_summary":"## Summary\n\nA single low-privilege `RoleMember` can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at `service/singleton/servicesentinel.go:601`. The worker checks a service exists under one lock and later writes to two pointer-valued status maps under a different lock; a concurrent delete removes the entries in the gap. Because the gRPC server has no recovery interceptor, the worker-goroutine panic kills the whole process. Availability only: nothing is read or modified.\n\n## Affected versions\n\nConfirmed in `v2.2.7` through `v2.2.10`. `service/singleton/servicesentinel.go` has the same vulnerable implementation in all four releases. The issue is fixed in `v2.2.11` and later; users should upgrade to the latest release, `v2.3.0`. \n\n## The bug\n\nThe worker validates an incoming report and later writes it to two status maps, but the check and the write are guarded by two different locks taken at two different times. Between them, the same member can delete the service and pull the map entries out from un","public_affected_ranges":[">= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d"]}],"null_published_at":"2026-11-01T01:03:56.632Z","source_updated_at":"2026-10-15T20:15:07.000Z","source_disclosed_at":"2026-10-15T20:15:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:22.124Z"}],"next_cursor":null,"snapshot_revision":"42594"}