NezhaHQ Nezha up to 2.3.2 URL Validator server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in NezhaHQ Nezha up to 2.3.2. This impacts an unknown function of the component URL Validator. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-101087. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in NezhaHQ Nezha up to 2.3.2. This issue affects some unknown processing of the component URL Validator. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because such addresses satisfy Go's netip.Addr.IsGlobalUnicast check, the URL validator accepted them. An authenticated user able to configure a webhook may be able to cause the dashboard to issue requests to an otherwise restricted IPv6 endpoint, but only where the dashboard's network provides unusual or non-standards-compliant routing for these transition ranges; no direct path to an IPv4 metadata, loopback, or private-network HTTP request has been demonstrated. The issue is fixed in version 2.3.3 (commit d1fcde8e), which blocks both prefixes.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-101087 since 09/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.3.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-88022). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NezhaHQ

Name

• Nezha

Version

• 2.3.0
• 2.3.1
• 2.3.2

Website

• Product: https://github.com/nezhahq/nezha/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion