CVE-2026-114139

npm/@sentry/nextjs CVE-2026-114139: critical 9.1

Sentry-Javascript: Middleware Bypass when using Tunnel route

Action: Upgrade @sentry/nextjs to 9.47.2 or later.

npm i @sentry/nextjs@9.47.2

npm i @sentry/nextjs@10.75.2

npm i @sentry/nextjs@11.0.0-rc.1

Affected

Fixed versions

Sources

• osv: GHSA-mchm-gjx6-7h55
• nvd: CVE-2026-114139
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
• https://github.com/getsentry/sentry-javascript/pull/24499
• https://github.com/getsentry/sentry-javascript/pull/24565
• https://github.com/getsentry/sentry-javascript/pull/24760
• https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
• https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
• https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
• https://github.com/getsentry/sentry-javascript
• https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2
• https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1
• https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2

CVE-2026-114139 · published 2026-10-22T15:55:07Z · modified 2026-10-22T16:00:09.116997075Z · JSON