CVE-2026-114139 · GHSA-mchm-gjx6-7h55
Sentry-Javascript: Middleware Bypass when using Tunnel route
- Risk score
- 71/100
- CVSS
- 9.1 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A middleware bypass vulnerability exists in Sentry-Javascript when using the Tunnel route, allowing an attacker to reach routes without middleware authorization. This requires a tunnelRoute, a webpack build, a colliding route, and middleware as the only authorization control.
- Affected
- {'products': ['Sentry-Javascript'], 'packages': [{'ecosystem': 'npm', 'name': '@sentry/nextjs', 'vulnerable': '>= 9.36.0, < 9.47.2'}, {'ecosystem': 'npm', 'name': '@sentry/nextjs', 'vulnerable': '>= 10.0.0-alpha.0, < 10.75.2'}, {'ecosystem': 'npm', 'name': '@sentry/nextjs', 'vulnerable': '>= 11.0.0-alpha.0, < 11.0.0-r…
- Fix
- Upgrade to versions 9.47.2, 10.75.2, or 11.0.0-rc.1
- Exploitation
- No known exploitation
Not confirmed. 11.0.0-r isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @sentry/nextjs | npm | >= 9.36.0, < 9.47.2 | 9.47.2 |
| @sentry/nextjs | npm | >= 10.0.0-alpha.0, < 10.75.2 | 10.75.2 |
| @sentry/nextjs | npm | >= 11.0.0-alpha.0, < 11.0.0-rc.1 | 11.0.0-rc.1 |
References
- https://github.com/advisories/GHSA-mchm-gjx6-7h55
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
- https://nvd.nist.gov/vuln/detail/CVE-2026-114139
- https://github.com/getsentry/sentry-javascript/pull/24499
- https://github.com/getsentry/sentry-javascript/pull/24565
- https://github.com/getsentry/sentry-javascript/pull/24760
- https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
- https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
- https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
- https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2
Original description
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
Last activity 21 Oct 2026. Patch Forecast updates every hour.