The vulnerability lies in Nezha's handling of alert rule parameters, a CWE-197 weakness. The application does not enforce strict validation on the alert rule type and duration boundaries. This oversight allows an authenticated but non-administrator user to submit malformed rules through the POST /api/v1/alert-rule endpoint. The malformed rule causes an unrecovered panic in the alert evaluator goroutine, leading to a crash of the dashboard process. Because the rule is persisted before the crash, each restart recreates the same faulty rule, resulting in repeated crashes that permanently disable monitoring and control plane features until the rule is removed or the application is restarted without it. The impact is a denial of service to the monitoring infrastructure.

The affected product is Nezha by nezhahq. Versions prior to 2.3.8 are vulnerable. Users deploying Nezha dashboards with any non-administrator account that has permission to create alert rules are susceptible.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers require authentication but do not need administrator privileges, making the attack vector relatively low barrier. Once a malicious rule is introduced, the system will crash until the rule is removed, providing full denial of service to the monitoring service.