Nezha versions 1.0.0 through 2.3.14 allow authenticated users with file manager scopes to send an oversized binary WebSocket message to /api/v1/ws/file/:id. Because the fmStream object never sets a read limit, the message size is unbounded, causing an out‑of‑memory condition that terminates the agent monitoring processes.

The vulnerability applies to the Nezha dashboard package supplied by nezhahq:nezha. All releases prior to 2.3.15 are affected; the vendor lists 1.0.0 to 2.3.14 as impacted.

The CVSS score of 7.1 indicates a moderate severity impact. The EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is confined to systems where an authenticated user has file manager privileges. In practice attackers would need internal access to the Nezha instance and the appropriate scope to trigger the OOM kill and disrupt monitoring.