{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@sentry/nextjs--11.0.0-alpha.0--11.0.0-rc.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sentry:sentry-javascript:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-114139"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@sentry/nextjs (\u003e= 9.36.0, \u003c 9.47.2)","@sentry/nextjs (\u003e= 10.0.0-alpha.0, \u003c 10.75.2)","@sentry/nextjs (\u003e= 11.0.0-alpha.0, \u003c 11.0.0-rc.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application","middleware-bypass","cve-2026-114139"],"_cs_type":"advisory","_cs_vendors":["Sentry"],"content_html":"\u003cp\u003eThe @sentry/nextjs SDK contains a middleware bypass vulnerability (CVE-2026-114139) affecting Webpack-based builds when the \u003ccode\u003etunnelRoute\u003c/code\u003e option is configured. The SDK is designed to forward browser events to a specific path (the tunnel) while skipping middleware to prevent request rejection. However, the logic incorrectly skips middleware for all requests under the tunnel path, not just those intended for Sentry. If an application route resolves under the configured tunnel path, and that route relies exclusively on middleware for authorization, an attacker can bypass these checks. Sentry services and organization data are not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to application routes that rely solely on middleware for authorization. Impact is limited to routes that overlap with the \u003ccode\u003etunnelRoute\u003c/code\u003e path. Access to the route is not granted additional privileges; routes with internal server-side session validation remain protected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@sentry/nextjs\u003c/code\u003e to version 9.47.2, 10.75.2, or 11.0.0-rc.1 or later to apply the patch that restricts middleware skipping to the specific tunnel rewrite.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, modify the \u003ccode\u003etunnelRoute\u003c/code\u003e configuration to a path that does not collide with existing application routes.\u003c/li\u003e\n\u003cli\u003eEnforce authorization checks within the route handlers, layouts, or data-access layers in addition to middleware, following a defense-in-depth approach.\u003c/li\u003e\n\u003cli\u003eTransition to Turbopack for builds, as it is not affected by this specific implementation flaw.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T20:00:27Z","date_published":"2026-10-22T20:00:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sentry-middleware-bypass/","summary":"A middleware bypass vulnerability in the @sentry/nextjs SDK allows unauthenticated access to routes if the configured tunnel path overlaps with application routes in Webpack-based builds.","title":"Sentry-Javascript: Middleware bypass via tunnelRoute (CVE-2026-114139)","url":"https://feed.craftedsignal.io/briefs/2026-10-sentry-middleware-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Sentry/Nextjs (\u003e= 11.0.0-Alpha.0, \u003c 11.0.0-Rc.1)","version":"https://jsonfeed.org/version/1.1"}