CVE-2026-111384
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 16, 2026
Vendor
unknown
Description
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.