CVE-2026-101085

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.3.8

Description Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST /api/v1/alert-rule' endpoint, an attacker can trigger unrecovered panics in the alert evaluator goroutine (a lightweight thread managed by the Go runtime). This results in a crash of the dashboard process; because the rule is persisted, the process will crash repeatedly upon restart, disabling all monitoring and control plane functionality.

Recommendations Update to version 2.3.8 or later. Avoid using the 'POST /api/v1/alert-rule' endpoint for non-administrator users until the update is applied.