Critical 9.1Published Oct 21, 2026

CVE-2026-114139Sentry-Javascript: Middleware Bypass when using Tunnel route

Updated under an hour ago (Oct 28, 2026, 10:40 AM ET)

Does this affect you?

It affects getsentry sentry-javascript. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.51%, higher than 43% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for getsentry sentry-javascript

Exploited in the last 30 days

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.

CVSS: 9.1 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-693
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.51% (percentile 43)
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Oct 27, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

getsentry sentry-javascript getsentry:sentry_javascript (from the name)	from 9.36.0, < 9.47.2; from 10.0.0-alpha.0, < 10.75.2; from 11.0.0-alpha.0, < 11.0.0-rc.1	CNA record

References

References

https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55	x-refsource-confirm
https://github.com/getsentry/sentry-javascript/pull/24499	x-refsource-misc
https://github.com/getsentry/sentry-javascript/pull/24565	x-refsource-misc
https://github.com/getsentry/sentry-javascript/pull/24760	x-refsource-misc
https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532	x-refsource-misc
https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae	x-refsource-misc
https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5	x-refsource-misc
https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2	x-refsource-misc
https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1	x-refsource-misc
https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.