Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@sentry/nextjs

3 known vulnerabilities (2 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release
11.11.0 (Nov 5, 2026): no advisory affects it
Newest unaffected release
11.11.0 (Nov 5, 2026), the latest release
Advisories
3 · 2 critical, 1 medium
Weekly downloads
16.3M
Dependents
6
Releases
500+ since 6.15.0 (Nov 16, 2021)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-114139
    Affects 9.36.0 to 9.47.1 (9.47.2 is outside it); 10.0.0-alpha.0 to 10.75.1 (10.75.2 is outside it); 11.0.0-alpha.0 to 11.0.0-rc.0 (11.0.0-rc.1 is outside it)
  • CVE-2025-65944
    Affects 10.11.0 to 10.26.0 (10.27.0 is outside it)
  • CVE-2023-46729
    Affects 7.26.0 to 7.76.0 (7.77.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 3

  • CVE-2026-114139Critical 9.1

    Sentry-Javascript: Middleware Bypass when using Tunnel route

    Affected: from 9.36.0, fixed in 9.47.2; from 10.0.0-alpha.0, fixed in 10.75.2; from 11.0.0-alpha.0, fixed in 11.0.0-rc.1.

    Fixed in 9.47.2 (released Sep 29, 2026, 22 days before disclosure), 10.75.2 (released Sep 22, 2026, 29 days before disclosure) and 11.0.0-rc.1 (released Sep 22, 2026, 29 days before disclosure).

    The latest release, 11.11.0, is not affected.

    35% of @sentry/nextjs downloads last week were affected versions (6.2M).

  • CVE-2025-65944Medium 5.1

    Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

    Affected: from 10.11.0, fixed in 10.27.0.

    Fixed in 10.27.0 (released Nov 24, 2025, 1 day before disclosure).

    The latest release, 11.11.0, is not affected.

    2% of @sentry/nextjs downloads last week were affected versions (344K).

  • CVE-2023-46729Critical 9.3

    Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

    Affected: from 7.26.0, fixed in 7.77.0.

    Fixed in 7.77.0 (released Oct 31, 2023, 10 days before disclosure).

    The latest release, 11.11.0, is not affected.

    0.1% of @sentry/nextjs downloads last week were affected versions (25.7K).