Go/github.com/nezhahq/nezha CVE-2026-101090: critical 9.8, EPSS 0.44%

Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

Action: No fix published. Pin and monitor.

Affected

No affected ranges in the source.

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-rf68-8gjr-36q7
• nvd: CVE-2026-101090
• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://github.com/nezhahq/nezha/commit/38824dbc11a63964c5b9296ae4c68e62b34fa04b
• https://github.com/nezhahq/nezha

CVE-2026-101090 · published 2026-09-15T19:50:08Z · modified 2026-09-28T17:11:14.221598075Z · JSON