CVE-2026-114139 in sentry-javascript
Summary
by MITRE • 10/21/2026
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within Sentry-Javascript SDKs affects specific releases of the @sentry/nextjs package, specifically spanning from version 9.36.0 up to 9.47.2, as well as versions 10.75.2 and 11.0.0-rc.1. This issue stems from a misconfiguration in how the webpack integration handles request routing when the tunnelRoute feature is enabled. The Sentry SDK utilizes a tunneling mechanism to send error reports through a custom endpoint rather than directly to Sentry servers, which can be useful for bypassing network restrictions or controlling data flow. However, the implementation of this feature introduces a critical logic flaw in the Next.js middleware execution pipeline during the build process.
The core technical flaw lies in how the webpack integration processes request paths relative to the configured tunnelRoute. When an application route directly collides with the defined tunnel path, or when a root dynamic segment resolves under that path, the integration incorrectly skips the execution of application middleware for every request falling under that specific URL pattern. This behavior is unintended and stems from the fact that while the tunnel rewrite mechanism correctly serves only the exact tunnel path with valid o and p query parameters, it fails to properly enforce middleware boundaries for overlapping or subordinate routes. Consequently, requests intended to be processed by authentication or authorization middleware are allowed to bypass these checks entirely if they match the colliding route structure.
This architectural weakness results in a significant security impact where unauthenticated users can access protected application routes that rely solely on Next.js middleware for authorization controls. Since the middleware is skipped during the build-time integration of the Sentry SDK, any request hitting the affected path does not undergo the standard authentication checks defined by the developer. This effectively creates an unauthorized access vector, allowing attackers to interact with sensitive endpoints without valid credentials. The severity of this vulnerability is heightened in environments where middleware serves as the primary or only line of defense for route protection, as it completely undermines the intended security posture of the application.
The exploitation of this flaw requires a specific set of conditions to be met simultaneously. First, the application must have the tunnelRoute feature enabled within its Sentry configuration. Second, the application must undergo a webpack build process that incorporates the affected versions of the @sentry/nextjs package. Third, there must exist an application route or dynamic segment that directly collides with or resolves under the configured tunnel path. Finally, middleware must be serving as the exclusive authorization control for these routes; if other forms of authentication are in place at a different layer, such as reverse proxy configurations, the impact may be mitigated but not eliminated entirely due to the bypass of application-level checks.
To mitigate this vulnerability, organizations using affected versions of Sentry-Javascript should immediately upgrade to patched releases where this logic error has been corrected. The issue is resolved in version 9.47.2 for the legacy branch and in versions 10.75.2 and 11.0.0-rc.1 for newer branches. Until an upgrade can be performed, administrators should consider restructuring their application routes to ensure no direct collision occurs between protected API endpoints or pages and the configured tunnelRoute path. Additionally, implementing defense-in-depth strategies by adding authentication checks at the infrastructure level, such as via load balancers or reverse proxies, can provide a secondary layer of protection against unauthorized access resulting from this middleware bypass.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the tunnel configuration is considered part of the security boundary logic. In terms of the MITRE ATT&CK framework, this flaw facilitates Initial Access by allowing unauthenticated users to reach protected resources, which could be categorized under T1078 Valid Accounts or more broadly as a bypass mechanism for access control mechanisms. The incident highlights the importance of rigorous testing when integrating third-party SDKs that modify build processes and request handling pipelines, particularly in frameworks like Next.js where middleware plays a central role in security enforcement.