npm/@sentry/sveltekit CVE-2025-65944: medium 5.1, EPSS 0.37%

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

Action: Upgrade @sentry/sveltekit to 10.27.0 or later.

npm i @sentry/sveltekit@10.27.0

Affected

Fixed versions

Sources

• osv: GHSA-6465-jgvq-jhgp#npm/@sentry/sveltekit
• nvd: CVE-2025-65944
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp
• https://github.com/getsentry/sentry-javascript/pull/17475
• https://github.com/getsentry/sentry-javascript/pull/18311
• https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539
• https://github.com/getsentry/sentry-javascript
• https://github.com/getsentry/sentry-javascript/releases
• https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
• https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0

CVE-2025-65944 · published 2025-11-24T21:52:45Z · modified 2026-08-07T08:12:16.735936479Z · JSON