Skip to content
OpenAdvisories

Package · npm

@sentry/nextjs

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.1
    CVE-2026-114139

    Sentry-Javascript: Middleware Bypass when using Tunnel route

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel re…

    getsentry sentry-javascript langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 5.1
    CVE-2025-65944

    Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Co…

    getsentry sentry-javascript @sentry/nextjs @sentry/astro npm
  • Low 3.7
    GHSA-r5w7-f542-q2j4

    Potential DoS when using ContextLines integration

    ### Impact The [ContextLines integration](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/contextlines/) uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach…

    @sentry/nextjs @sentry/astro @sentry/aws-serverless @sentry/google-cloud-serverless npm
  • Critical 9.3
    CVE-2023-46729

    Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

    sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunnelin…

    getsentry sentry-javascript @sentry/nextjs npm