Sentry @sentry/nextjs: Middleware bypass via tunnelRoute
Summary
The webpack integration of the Sentry JavaScript SDK for Next.js skips application middleware for all request paths under a configured tunnelRoute. If an application route collides with the tunnel path, an unauthenticated remote attacker can reach that route without the middleware authorization check. The issue requires tunnelRoute to be set, a webpack build, a colliding route, and middleware as the only authorization control. Routes that verify sessions server-side are not bypassed by this issue.
Affected
- @sentry/nextjs >= 9.36.0, < 9.47.2
- @sentry/nextjs >= 10.0.0-alpha.0, < 10.75.2
- @sentry/nextjs >= 11.0.0-alpha.0, < 11.0.0-rc.1
- Only apps with tunnelRoute set, built with webpack (Turbopack builds are not affected)
Fixed in
- 9.47.2
- 10.75.2
- 11.0.0-rc.1
- Later releases in the same line also contain the fix.
Workaround
- Set tunnelRoute to a path that no route of your application can resolve to, or remove the tunnelRoute option.
- Enforce authorization in the route, layout or data-access layer and not only in middleware.
Exploitation
- CVSS 4.0 base score 9.1 (critical), network attack vector, no privileges and no user interaction required.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No known exploitation in the wild and no public proof of concept found at the time of research.
Our recommendation
- Check whether @sentry/nextjs is used (for example with npm ls @sentry/nextjs) and whether tunnelRoute is set.
- Upgrade to 9.47.2, 10.75.2, 11.0.0-rc.1 or a later release of your major version.
- If tunnelRoute is set, review routes protected only by middleware and add server-side authorization checks.
- Prioritise internet-facing Next.js applications.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mchm-gjx6-7h55 github.com
- Fix commit 878b685 (main) github.com
- Fix commit c122aac github.com
- Release 9.47.2 github.com
- Release 10.75.2 github.com
- Release 11.0.0-rc.1 github.com
- OSV entry GHSA-mchm-gjx6-7h55 osv.dev
- GitHub Advisory GHSA-mchm-gjx6-7h55 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:34.
Original description (NVD)
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
NVD references (10)
- https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
- https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
- https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
- https://github.com/getsentry/sentry-javascript/pull/24499
- https://github.com/getsentry/sentry-javascript/pull/24565
- https://github.com/getsentry/sentry-javascript/pull/24760
- https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2
- https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1
- https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.