Unauthorized Access Vulnerability in Sentry-Javascript SDK by Sentry
CVE-2026-114139
What is CVE-2026-114139?
The Sentry-Javascript SDK, specifically from versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1, contains a flaw in its webpack integration for the @sentry/nextjs package. This flaw allows an unauthenticated request to bypass application middleware for paths defined under a configured tunnelRoute. If an application route conflicts with the tunnel path, an attacker can exploit this issue to gain access without proper authorization, provided that authorization is solely managed by the middleware. It is recommended that users upgrade to fixed versions 9.47.2, 10.75.2, or 11.0.0-rc.1 to mitigate this security risk.
Affected Version(s)
sentry-javascript >= 9.36.0, < 9.47.2 < 9.36.0, 9.47.2
sentry-javascript >= 10.0.0-alpha.0, < 10.75.2 < 10.0.0-alpha.0, 10.75.2
sentry-javascript >= 11.0.0-alpha.0, < 11.0.0-rc.1 < 11.0.0-alpha.0, 11.0.0-rc.1