Vulnerability-Lookup

CVE-2025-65944 (GCVE-0-2025-65944)

Vulnerability from cvelistv5 – Published: 2025-11-25 00:23 – Updated: 2025-11-25 14:33

Title

Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

Summary

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-25 14:32 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7797 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/getsentry/sentry-javascript/se…	x_refsource_CONFIRM
https://github.com/getsentry/sentry-javascript/pu…	x_refsource_MISC
https://github.com/getsentry/sentry-javascript/co…	x_refsource_MISC
https://github.com/getsentry/sentry-javascript/re…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
getsentry	sentry-javascript	Affected: >= 10.11.0, < 10.27.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-65944",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T14:32:50.118977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T14:33:37.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sentry-javascript",
          "vendor": "getsentry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.11.0, \u003c 10.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T00:23:53.215Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"
        },
        {
          "name": "https://github.com/getsentry/sentry-javascript/pull/17475",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getsentry/sentry-javascript/pull/17475"
        },
        {
          "name": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"
        },
        {
          "name": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6465-jgvq-jhgp",
        "discovery": "UNKNOWN"
      },
      "title": "Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-65944",
    "datePublished": "2025-11-25T00:23:53.215Z",
    "dateReserved": "2025-11-18T16:14:56.691Z",
    "dateUpdated": "2025-11-25T14:33:37.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-65944",
      "date": "2026-10-26",
      "epss": "0.00369",
      "percentile": "0.30518"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "sentry-javascript",
                "vendor": "getsentry",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 10.11.0, \u003c 10.27.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0."
          },
          {
            "lang": "es",
            "value": "Sentry-Javascript es un SDK oficial de Sentry para JavaScript. Desde la versi\u00f3n 10.11.0 hasta la 10.27.0, cuando una aplicaci\u00f3n Node.js que utiliza el SDK de Sentry tiene sendDefaultPii: true, es posible enviar inadvertidamente ciertos encabezados HTTP sensibles, incluyendo el encabezado Cookie, a Sentry. Esos encabezados se almacenar\u00edan dentro de una organizaci\u00f3n de Sentry como parte del rastreo asociado. Una persona con acceso a la organizaci\u00f3n de Sentry podr\u00eda entonces ver y usar estos valores sensibles para suplantar o escalar sus privilegios dentro de la aplicaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 10.27.0."
          }
        ],
        "id": "CVE-2025-65944",
        "lastModified": "2026-10-18T20:10:00.110",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-65944",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T14:32:50.118977Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-25T01:15:46.623",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getsentry/sentry-javascript/pull/17475"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-201"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-12-02T07:22:42+00:00",
      "cve": "CVE-2025-65944",
      "id": "CVE-2025-65944",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65944.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-65944",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-25T14:32:50.118977Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-25T14:33:31.226Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "sentry-javascript",
              "vendor": "getsentry",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 10.11.0, \u003c 10.27.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "HIGH",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-201",
                  "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-25T00:23:53.215Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"
            },
            {
              "name": "https://github.com/getsentry/sentry-javascript/pull/17475",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getsentry/sentry-javascript/pull/17475"
            },
            {
              "name": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"
            },
            {
              "name": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"
            }
          ],
          "source": {
            "advisory": "GHSA-6465-jgvq-jhgp",
            "discovery": "UNKNOWN"
          },
          "title": "Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-65944",
        "datePublished": "2025-11-25T00:23:53.215Z",
        "dateReserved": "2025-11-18T16:14:56.691Z",
        "dateUpdated": "2025-11-25T14:33:37.980Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-65944

Vulnerability from fkie_nvd - Published: 2025-11-25 01:15 - Updated: 2026-10-18 20:10

Severity

5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539
	security-advisories@github.com	https://github.com/getsentry/sentry-javascript/pull/17475
	security-advisories@github.com	https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
	security-advisories@github.com	https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sentry-javascript",
          "vendor": "getsentry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.11.0, \u003c 10.27.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0."
    },
    {
      "lang": "es",
      "value": "Sentry-Javascript es un SDK oficial de Sentry para JavaScript. Desde la versi\u00f3n 10.11.0 hasta la 10.27.0, cuando una aplicaci\u00f3n Node.js que utiliza el SDK de Sentry tiene sendDefaultPii: true, es posible enviar inadvertidamente ciertos encabezados HTTP sensibles, incluyendo el encabezado Cookie, a Sentry. Esos encabezados se almacenar\u00edan dentro de una organizaci\u00f3n de Sentry como parte del rastreo asociado. Una persona con acceso a la organizaci\u00f3n de Sentry podr\u00eda entonces ver y usar estos valores sensibles para suplantar o escalar sus privilegios dentro de la aplicaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 10.27.0."
    }
  ],
  "id": "CVE-2025-65944",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-65944",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-25T14:32:50.118977Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-25T01:15:46.623",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getsentry/sentry-javascript/pull/17475"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6465-JGVQ-JHGP

Vulnerability from github – Published: 2025-11-24 21:52 – Updated: 2025-11-27 07:56

Summary

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

Details

Impact

In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When sendDefaultPii: true was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.

Sentry’s server-side scrubbing (handled by Sentry's Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.

Users may be impacted if:

Their Sentry SDK configuration has sendDefaultPii set to true
Their application uses one of the Node.js Sentry SDKs with version from 10.11.0 to 10.26.0 inclusively:
@sentry/astro
@sentry/aws-serverless
@sentry/bun
@sentry/google-cloud-serverless
@sentry/nestjs
@sentry/nextjs
@sentry/node
@sentry/node-core
@sentry/nuxt
@sentry/remix
@sentry/solidstart
@sentry/sveltekit

Users can check if their project was affected, by visiting Explore → Traces and searching for “http.request.header.authorization”, “http.request.header.cookie” or similar. Any potentially sensitive values will be specific to users' applications and configurations.

Patches

The issue has been patched in all Sentry JavaScript SDKs starting from the 10.27.0 version.

Workarounds

Sentry strongly encourage customers to upgrade the SDK to the latest available version, 10.27.0 or later. If it is not possible, consider setting sendDefaultPii: false to avoid unintentionally sending sensitive headers. See here for documentation.

Resources

https://develop.sentry.dev/sdk/expected-features/data-handling/#sensitive-data
https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
https://github.com/getsentry/sentry-javascript/pull/17475
https://docs.sentry.io/platforms/javascript/guides/node/data-management/data-collected/#cookies

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/astro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/aws-serverless"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/bun"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/google-cloud-serverless"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/nestjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/nextjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/node-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/remix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/solidstart"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sentry/sveltekit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65944"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-24T21:52:45Z",
    "nvd_published_at": "2025-11-25T01:15:46Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When `sendDefaultPii: true` was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.\n\nSentry\u2019s server-side scrubbing (handled by Sentry\u0027s Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.\n\nUsers may be impacted if:\n\n1. Their Sentry SDK configuration has `sendDefaultPii` set to `true`\n2. Their application uses one of the Node.js Sentry SDKs with version from `10.11.0` to `10.26.0` inclusively:\n- @sentry/astro\n- @sentry/aws-serverless\n- @sentry/bun\n- @sentry/google-cloud-serverless\n- @sentry/nestjs\n- @sentry/nextjs\n- @sentry/node\n- @sentry/node-core\n- @sentry/nuxt\n- @sentry/remix\n- @sentry/solidstart\n- @sentry/sveltekit\n\nUsers can check if their project was affected, by visiting Explore \u2192 Traces and searching for \u201chttp.request.header.authorization\u201d, \u201chttp.request.header.cookie\u201d or similar. Any potentially sensitive values will be specific to users\u0027 applications and configurations.\n\n### Patches\nThe issue has been patched in all Sentry JavaScript SDKs starting from the [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) version.\n\n### Workarounds\nSentry strongly encourage customers to upgrade the SDK to the latest available version, [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) or later.\nIf it is not possible, consider setting `sendDefaultPii: false` to avoid unintentionally sending sensitive headers. See [here](https://docs.sentry.io/platforms/javascript/guides/node/#step-2-configure) for documentation.\n\n### Resources\n* https://develop.sentry.dev/sdk/expected-features/data-handling/#sensitive-data\n* https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0\n* https://github.com/getsentry/sentry-javascript/pull/17475\n* https://docs.sentry.io/platforms/javascript/guides/node/data-management/data-collected/#cookies",
  "id": "GHSA-6465-jgvq-jhgp",
  "modified": "2025-11-27T07:56:25Z",
  "published": "2025-11-24T21:52:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65944"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/pull/17475"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/pull/18311"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getsentry/sentry-javascript"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/releases"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Sentry\u0027s sensitive headers are leaked when `sendDefaultPii` is set to `true`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-65944 (GCVE-0-2025-65944)

FKIE_CVE-2025-65944

GHSA-6465-JGVQ-JHGP

Impact

Patches

Workarounds

Resources

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour