CVE-2026-105113

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

An authenticated low-privileged user can permanently deadlock the alerting subsystem and cause memory exhaustion, leading to denial of service. This can paralyze monitoring and incident response.

Update Nezha Dashboard to version 2.3.13 or later. Restrict permissions for non-admin users and monitor unusual notification API calls.