Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-14 | 1 | Disclosure1 |
| 2026-06-27 | 1 | General1 |
🟠 Nezha Dashboard, Uncontrolled Resource Consumption, #CVE-2026-53522 (Medium) -DC-Jun2026-719 https://dailycve.com/nezha-dashboard-uncontrolled-resource-consumption-cve-2026-53522-medium-dc-jun2026-719/
Post summary
The message reports a Medium‑severity uncontrolled resource consumption vulnerability (CVE‑2026‑53522) in Nezha Dashboard, offering only basic details without any PoC, exploit, patch, or active exploitation information.
CVE-2026-53522 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard expose… https://www.cve.org/CVERecord?id=CVE-2026-53522
Post summary
The entry notes that CVE‑2026‑53522 is present in Nezha Monitoring dashboards prior to version 2.2.0 but offers no further technical details, PoC, or mitigation information.