Nezha Monitoring Whole-Instance DoS via Race Condition

A low-privilege member can crash the entire Nezha dashboard by racing a service delete with a monitoring result write, causing a nil pointer dereference that kills the process and takes all tenants' web UI, REST API, and agent connections offline.

Disclosed 15 October 2026 · Record updated 15 October 2026

Impact

Complete availability loss for all tenants' dashboard, REST API, and agent connections through process crash via nil pointer dereference

Our coverage

A single worker pulls one thread in a vast tapestry of interconnected gears, causing the entire machine to seize and collapse into stillness.

Vulnerabilities

Nezha dashboard can be crashed by any low-privilege member

A reported race condition lets a single ordinary user take down the whole monitoring instance, knocking out every tenant's web UI, API and agents.

15 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-qjpp-gffx-2wm9