{"action":"Upgrade @sentry/nextjs to 9.47.2 or later.","affected":[{"fixed":"9.47.2","introduced":"9.36.0"},{"fixed":"10.75.2","introduced":"10.0.0-alpha.0"},{"fixed":"11.0.0-rc.1","introduced":"11.0.0-alpha.0"}],"component":"@sentry/nextjs","cve_ids":["CVE-2026-114139"],"ecosystem":"npm","exploited":false,"fixed_versions":["9.47.2","10.75.2","11.0.0-rc.1"],"ghsa_id":"GHSA-mchm-gjx6-7h55","id":"tcs_01M5JMC5H3QPE43HQP40MET920","modified_at":"2026-10-22T16:00:09.116997075Z","published_at":"2026-10-22T15:55:07Z","references":["https://osv.dev/vulnerability/GHSA-mchm-gjx6-7h55","https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55","https://nvd.nist.gov/vuln/detail/CVE-2026-114139","https://github.com/getsentry/sentry-javascript/pull/24499","https://github.com/getsentry/sentry-javascript/pull/24565","https://github.com/getsentry/sentry-javascript/pull/24760","https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532","https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae","https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5","https://github.com/getsentry/sentry-javascript","https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2","https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1","https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-mchm-gjx6-7h55","url":"https://osv.dev/vulnerability/GHSA-mchm-gjx6-7h55"},{"source":"nvd","source_id":"CVE-2026-114139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114139"}],"summary":"Sentry-Javascript: Middleware Bypass when using Tunnel route"}