Code in master branch.
Thank you for your contribution to open source security, please submit on https://github.com/nezhahq/nezha/security
Security: nezhahq/nezha
Security
SECURITY.md
-
The 2026-07-21 whole-instance DoS fix re-validated the service lifecycle under one lock but reused the stale reporter pointer and never re-validated the server, so a concurrent delete of the member's own server reintroduces the same nil dereference in the same un-recovered worker (incomplete fix of GHSA-qjpp-gffx-2wm9)GHSA-jx78-55p5-rwv5 published
Aug 1, 2026 by naibaModerate -
Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantGHSA-qjpp-gffx-2wm9 published
Jul 21, 2026 by naibaModerate -
Authenticated users can read their own bcrypt password hash via GET /api/v1/profileGHSA-8jhq-g4gw-rv5f published
Jun 28, 2026 by naibaLow -
OAuth2 redirect_uri Host header injection regression when dashboard_host is emptyGHSA-rf68-8gjr-36q7 published
Jun 20, 2026 by naibaLow -
DDNS and Notification credential exposure via unredacted list APIGHSA-ww5p-j6cj-6mqq published
Jun 20, 2026 by naibaModerate -
OAuth2 Redirect URL — Host Header InjectionGHSA-9rc6-8cjv-rcvx published
Jun 5, 2026 by naibaModerate -
Unbounded WebSocket Streams — Resource Exhaustion DoSGHSA-jg62-j5h6-8mpq published
Jun 5, 2026 by naibaModerate -
Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextGHSA-39g2-8x68-pmx8 published
May 31, 2026 by naibaModerate -
Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingGHSA-x6fg-52vr-hj4w published
May 31, 2026 by naibaModerate -
Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataGHSA-vrmh-5mmx-hjwx published
May 26, 2026 by naibaLow
Learn more about advisories related to nezhahq/nezha in the GitHub Advisory Database