CVE-2026-114139
CRITICAL
INFO
Priority: 0.05
BB Relevance:
78/100
Published: 2026-10-21
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
None
Description
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| getsentry | sentry-javascript | >= 9.36.0, < 9.47.2 |
| getsentry | sentry-javascript | >= 10.0.0-alpha.0, < 10.75.2 |
| getsentry | sentry-javascript | >= 11.0.0-alpha.0, < 11.0.0-rc.1 |
| getsentry | sentry-javascript | >= 9.36.0, < 9.47.2 |
| getsentry | sentry-javascript | >= 10.0.0-alpha.0, < 10.75.2 |
| getsentry | sentry-javascript | >= 11.0.0-alpha.0, < 11.0.0-rc.1 |