CVE-2026-114139

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

Sentry-Javascript is an official Sentry SDKs for JavaScript.

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-10-21 21:17

Modified: 2026-10-28 02:17

NVD status: Awaiting Analysis

Last synced 18 hours ago

Verified against the source API 2026-10-28 11:30 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-693

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7a... security-advisories@github.com
https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3c... security-advisories@github.com
https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d... security-advisories@github.com
https://github.com/getsentry/sentry-javascript/pull/24499 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/pull/24565 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/pull/24760 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2 security-advisories@github.com
https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-28 11:30 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores