CVE-2026-53522

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.0.0 through 2.1.x

Description The dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: "/api/v1/terminal" which triggers the createTerminal() function, and "/api/v1/file" which triggers the createFM() function. Both functions call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...), inserting a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams). The system lacks per-user rate limits, a global semaphore, and per-server connection caps, allowing for potential resource exhaustion.

Recommendations Update to version 2.2.0.