Nezha Monitoring exposes two WebSocket endpoints that allow creation of long‑lived streams to agents. Each request creates a new stream context stored in an unbounded map without any per‑user or global limits. The absence of rate limiting or a connection cap allows an attacker to overwhelm system memory and CPU by opening many concurrent streams, resulting in degraded performance or application crashes. The weakness corresponds to CWE‑770, which relates to resource exhaustion vulnerabilities.

Vendors: nezhahq:nezha. Products: Nezha Monitoring Dashboard. Affected versions: all releases from 1.0.0 up to, but not including, 2.2.0. The patch introduced in 2.2.0 removes the unbounded map and implements limits.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, suggesting a low to moderate likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the open WebSocket endpoints over the public network, and with sufficient traffic a single malicious user could exhaust server resources. The lack of built‑in limits makes the exploit trivial once the endpoint is reachable.