CVE-2026-100394

Deferred Deferred - Pending Action

Nezha Monitoring Dashboard Process Termination via Nil Pointer Dereference

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100394

EUVD

EUVD-2026-101303

Affected Vendors & Products

Vendor	Product	Version / Range
nezhahq	nezha	>= 2.2.7, < 2.2.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in Nezha Monitoring versions 2.2.7 to 2.2.11. A low-privilege user (RoleMember) can delete a service while the system is checking and updating its status. This causes a nil pointer dereference in the service-monitor worker, leading to a panic that crashes the entire dashboard process. The gRPC server lacks a recovery interceptor, so the crash disrupts all tenants' web interfaces, REST APIs, and agent connections.

Detection Guidance

This vulnerability is specific to Nezha Monitoring versions 2.2.7 through 2.2.10 and involves a race condition causing nil pointer dereferences. Detection requires checking the installed Nezha version and monitoring for dashboard crashes or process terminations during concurrent service report and delete operations.

Impact Analysis

The impact is limited to availability. The dashboard and all monitoring services become unavailable for all tenants. Users cannot access the web UI, REST API, or agent connections. No data is disclosed or modified. The attack requires low privileges and can be executed by any RoleMember through normal actions like reporting ping results.

Compliance Impact

This vulnerability primarily impacts availability by crashing the Nezha dashboard process, disrupting web UI, REST API, and agent connections for all tenants. It does not disclose or modify data, so direct impacts on GDPR or HIPAA compliance are limited. However, prolonged downtime could affect service availability, potentially violating uptime requirements in compliance frameworks.

Mitigation Strategies

Upgrade Nezha Monitoring to version 2.2.11 or later to patch the race condition and prevent the nil pointer dereference.
Restart the Nezha dashboard process after upgrading to ensure the fix is applied.
Monitor the dashboard logs for crashes or panics, which may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-100394. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70