https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 22:54:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114139 <p>Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.</p> <p>Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114139 https://db.gcve.eu/vuln/ghsa-mchm-gjx6-7h55 <p><strong>Affected:</strong> npm: @sentry/nextjs</p> <p>### Impact</p> <p>The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.</p> <p>The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.</p> <p>Skipping middleware does not grant the request any privileges. Routes that check the session server-side are still protected.</p> <p>You are affected only if **all** of the following are true:</p> <p>1. `tunnelRoute` is set (a string path or `true`), 2. your app is built with **webpack** (Turbopack builds are not affected), 3. some route of your application resolves under the tunnel path. That could be a direct collision (`/monitoring/foo` with `tunnelRoute: &#39;/monitoring&#39;`) or a dynamic segment at the route root (`app/[locale]/…`), which matches any first path segment, and 4. your middleware is the only place that enforces authorization for those routes.</p> <p>Sentry&#39;s own services, and the data in your Sentry organization, are not affected.</p> <p>### Patches</p> <p>Fixed in [9.47.2](https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2), [10.75.2](https://github.com/getsen…</p> <p><strong>Affected:</strong> npm: @sentry/nextjs</p> <p>### Impact</p> <p>The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.</p> <p>The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.</p> <p>Skipping middleware does not grant the request any privileges. Routes that check the session server-side are still protected.</p> <p>You are affected only if **all** of the following are true:</p> <p>1. `tunnelRoute` is set (a string path or `true`), 2. your app is built with **webpack** (Turbopack builds are not affected), 3. some route of your application resolves under the tunnel path. That could be a direct collision (`/monitoring/foo` with `tunnelRoute: &#39;/monitoring&#39;`) or a dynamic segment at the route root (`app/[locale]/…`), which matches any first path segment, and 4. your middleware is the only place that enforces authorization for those routes.</p> <p>Sentry&#39;s own services, and the data in your Sentry organization, are not affected.</p> <p>### Patches</p> <p>Fixed in [9.47.2](https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2), [10.75.2](https://github.com/getsen…</p> https://db.gcve.eu/vuln/ghsa-mchm-gjx6-7h55