npm/@sentry/nestjs CVE-2025-65944: medium, EPSS 0.34%

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

Action: Upgrade @sentry/nestjs to 10.27.0 or later.

npm i @sentry/nestjs@10.27.0

Affected

Fixed versions

Sources

• osv: GHSA-6465-jgvq-jhgp#npm/@sentry/nestjs
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp
• https://nvd.nist.gov/vuln/detail/CVE-2025-65944
• https://github.com/getsentry/sentry-javascript/pull/17475
• https://github.com/getsentry/sentry-javascript/pull/18311
• https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539
• https://github.com/getsentry/sentry-javascript
• https://github.com/getsentry/sentry-javascript/releases
• https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
• https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0

CVE-2025-65944 · published 2025-11-24T21:52:45Z · modified 2026-08-07T08:12:16.735936479Z · JSON