Description

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-27T21:17:02.307Z",
  "pubdate": "2026-09-27T21:17:02.307Z",
  "executiveSummary": "Nezha versions prior to 2.3.8 are susceptible to a critical Denial of Service (DoS) vulnerability originating from insufficient input validation of alert rules.\nThe vulnerability allows authenticated non-administrator users to inject malformed rule parameters, specifically targeting alert rule types and duration bounds.\nSuccessful exploitation triggers an unhandled panic within the alert evaluator goroutine, leading to the immediate termination of the dashboard process.\nBecause the malicious payload is persisted within the system database, the application enters an irrecoverable crash loop upon subsequent service restarts, resulting in a complete loss of monitoring and control plane availability.\nThis vulnerability highlights a critical failure in server-side input sanitization and error handling, presenting significant operational risks to users relying on the dashboard for infrastructure oversight.\nExploitation requires active authentication but does not require administrative privileges, significantly expanding the potential attack surface within multi-user environments.",
  "technicalDetails": "The root cause of the vulnerability lies in the lack of robust input validation mechanisms within the alert rule configuration logic. Specifically, the application fails to enforce strict type checking and range validation for the duration and rule-type fields processed by the alert evaluator.\nThe vulnerability resides within the logic handling requests sent to the POST /api/v1/alert-rule endpoint. When a user submits a crafted payload containing invalid or malicious parameters for rule type and duration, the alert evaluator attempts to process this data without defensive checks.\nThe attack flow begins with an authenticated attacker submitting a request to the /api/v1/alert-rule endpoint. By injecting malformed data that violates the internal constraints of the evaluator engine, the attacker induces a runtime exception within the alert evaluator goroutine. Because this specific goroutine does not implement adequate recovery mechanisms (such as panic recovery/deferred functions), the exception propagates to the global scope, forcing the entire Nezha dashboard process to terminate abruptly.\nDue to the nature of the application architecture, these malformed alert rules are committed to the backend database. Consequently, the invalid rule remains persisted across process restarts. Upon service initialization, the system attempts to reload the existing alert configurations, immediately triggering the same panic state in the alert evaluator. This creates a persistent DoS state that requires manual database intervention to resolve, as the dashboard remains unreachable until the offending record is removed from the persistent storage.\nThis vulnerability is classified as a logic error leading to a DoS condition. It effectively bypasses authorization boundaries by allowing lower-privileged users to disrupt critical infrastructure monitoring services. The impact is absolute, as it cripples the control plane functionality, preventing the monitoring of managed nodes and the management of current alert states. There are no client-side mitigations possible; the vulnerability is strictly server-side, and the impact persists indefinitely until administrative remediation occurs at the data layer."
}