NULL Pointer Dereference in Nezha Dashboard Affecting Authenticated Users

CVE-2026-120046

What is CVE-2026-120046?

The Nezha software versions prior to 2.4.0 are susceptible to a NULL pointer dereference vulnerability in the ServiceSentinel.loadTodayStats function. This issue arises when an authenticated user deletes their own service through the POST /api/v1/batch-delete/service endpoint. The deletion inadvertently leaves orphaned service_histories rows, which can cause the dashboard to crash on the next startup, requiring manual intervention to resolve. The problem highlights a critical gap in handling service deletions, emphasizing the need for robust error checks and data integrity measures.

References