Sentry-Javascript: Middleware bypass via tunnelRoute (CVE-2026-114139)

The @sentry/nextjs SDK contains a middleware bypass vulnerability (CVE-2026-114139) affecting Webpack-based builds when the tunnelRoute option is configured. The SDK is designed to forward browser events to a specific path (the tunnel) while skipping middleware to prevent request rejection. However, the logic incorrectly skips middleware for all requests under the tunnel path, not just those intended for Sentry. If an application route resolves under the configured tunnel path, and that route relies exclusively on middleware for authorization, an attacker can bypass these checks. Sentry services and organization data are not affected.

Impact

Successful exploitation allows unauthorized access to application routes that rely solely on middleware for authorization. Impact is limited to routes that overlap with the tunnelRoute path. Access to the route is not granted additional privileges; routes with internal server-side session validation remain protected.

Recommendation

• Upgrade @sentry/nextjs to version 9.47.2, 10.75.2, or 11.0.0-rc.1 or later to apply the patch that restricts middleware skipping to the specific tunnel rewrite.
• If immediate patching is not possible, modify the tunnelRoute configuration to a path that does not collide with existing application routes.
• Enforce authorization checks within the route handlers, layouts, or data-access layers in addition to middleware, following a defense-in-depth approach.
• Transition to Turbopack for builds, as it is not affected by this specific implementation flaw.