CVE-2026-111385

Nezha versions 2.1.0 before 2.3.15 are vulnerable to a Host Header Injection in the mintTransferTool component. The vulnerability occurs because the application builds fs.download_url and fs.upload_url transfer URLs using an unvalidated Host header . An attacker controlling the Host header in a v...