# @sentry/nextjs (npm) vulnerabilities

3 known vulnerabilities (2 critical, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 11.11.0 (Nov 5, 2026): no advisory affects it
- Newest unaffected release: 11.11.0 (Nov 5, 2026), the latest release
- Weekly downloads: 16.3M
- Dependents: 6
- Releases: 500+ since 6.15.0 (Nov 16, 2021)
- Registry: https://www.npmjs.com/package/@sentry/nextjs
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-114139: 9.36.0 to 9.47.1 (9.47.2 is outside it); 10.0.0-alpha.0 to 10.75.1 (10.75.2 is outside it); 11.0.0-alpha.0 to 11.0.0-rc.0 (11.0.0-rc.1 is outside it)
- CVE-2025-65944: 10.11.0 to 10.26.0 (10.27.0 is outside it)
- CVE-2023-46729: 7.26.0 to 7.76.0 (7.77.0 is outside it)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (3)

### [CVE-2026-114139](https://cve.now/CVE-2026-114139): Sentry-Javascript: Middleware Bypass when using Tunnel route

- Severity: Critical 9.1
- Published: Oct 21, 2026
- Affected: from 9.36.0, fixed in 9.47.2; from 10.0.0-alpha.0, fixed in 10.75.2; from 11.0.0-alpha.0, fixed in 11.0.0-rc.1.
- Fixed in 9.47.2 (released Sep 29, 2026, 22 days before disclosure), 10.75.2 (released Sep 22, 2026, 29 days before disclosure) and 11.0.0-rc.1 (released Sep 22, 2026, 29 days before disclosure).
- The latest release, 11.11.0, is not affected.
- 35% of @sentry/nextjs downloads last week were affected versions (6.2M).

### [CVE-2025-65944](https://cve.now/CVE-2025-65944): Sentry-Javascript deals with leaked sensitive headers when \`sendDefaultPii\` is set to \`true\`

- Severity: Medium 5.1
- Published: Nov 25, 2025
- Affected: from 10.11.0, fixed in 10.27.0.
- Fixed in 10.27.0 (released Nov 24, 2025, 1 day before disclosure).
- The latest release, 11.11.0, is not affected.
- 2% of @sentry/nextjs downloads last week were affected versions (344K).

### [CVE-2023-46729](https://cve.now/CVE-2023-46729): Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

- Severity: Critical 9.3
- Published: Nov 10, 2023
- Affected: from 7.26.0, fixed in 7.77.0.
- Fixed in 7.77.0 (released Oct 31, 2023, 10 days before disclosure).
- The latest release, 11.11.0, is not affected.
- 0.1% of @sentry/nextjs downloads last week were affected versions (25.7K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@sentry/nextjs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.