{"action":"Upgrade @sentry/nextjs to 7.77.0 or later.","affected":[{"fixed":"7.77.0","introduced":"7.26.0"}],"component":"@sentry/nextjs","cve_ids":["CVE-2023-46729"],"ecosystem":"npm","epss":0.00631,"exploited":false,"fixed_versions":["7.77.0"],"ghsa_id":"GHSA-2rmr-xw8m-22q9","id":"tcs_01M5KEV0Y0JESV32N5EYQZH5V4","modified_at":"2026-09-10T03:49:58.724315687Z","published_at":"2023-11-09T22:03:44Z","references":["https://osv.dev/vulnerability/GHSA-2rmr-xw8m-22q9","https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9","https://nvd.nist.gov/vuln/detail/CVE-2023-46729","https://github.com/getsentry/sentry-javascript/pull/9415","https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be","https://blog.sentry.io/next-js-sdk-security-advisory-cve-2023-46729","https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/#configure-tunneling-to-avoid-ad-blockers","https://github.com/getsentry/sentry-javascript","https://www.npmjs.com/package/@sentry/nextjs/v/7.77.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2rmr-xw8m-22q9","url":"https://osv.dev/vulnerability/GHSA-2rmr-xw8m-22q9"}],"summary":"Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint"}