CVE-2026-53522 Details
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.
A denial-of-service vulnerability has been identified in Nezha Monitoring versions 1.0.0 prior to 2.2.0. The issue arises because the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents, without any per-user rate limit, global semaphore, or per-server connection cap. This unbounded stream creation can exhaust server resources, including memory and processing power, leading to a denial-of-service condition on both the dashboard and the monitored agents.
To address this vulnerability, Nezha Monitoring should implement per-user stream limits, per-server concurrency controls, and rate limiting on the affected endpoints. Additionally, a configurable setting for maximum streams per user and per server should be introduced, allowing operators to adjust limits as needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nezha Monitoring | >= 1.0.0, < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |