---
id: CVE-2026-114139
title: 'Sentry-Javascript: Middleware Bypass when using Tunnel route'
summary: >-
  Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until
  9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs
  skips application middleware for every request path under a configured
  tunnelRout…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-693
vendor: getsentry
product: sentry-javascript
affected:
  - 'sentry-javascript >= 9.36.0, < 9.47.2'
  - 'sentry-javascript >= 10.0.0-alpha.0, < 10.75.2'
  - 'sentry-javascript >= 11.0.0-alpha.0, < 11.0.0-rc.1'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T20:14:34.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114139'
references:
  - url: >-
      https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
    label: >-
      https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
  - url: 'https://github.com/getsentry/sentry-javascript/pull/24499'
    label: 'https://github.com/getsentry/sentry-javascript/pull/24499'
  - url: 'https://github.com/getsentry/sentry-javascript/pull/24565'
    label: 'https://github.com/getsentry/sentry-javascript/pull/24565'
  - url: 'https://github.com/getsentry/sentry-javascript/pull/24760'
    label: 'https://github.com/getsentry/sentry-javascript/pull/24760'
  - url: >-
      https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
    label: >-
      https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
  - url: >-
      https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
    label: >-
      https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
  - url: >-
      https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
    label: >-
      https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
  - url: 'https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2'
    label: 'https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2'
  - url: 'https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1'
    label: 'https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1'
  - url: 'https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2'
    label: 'https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2'
tags:
  - cve.org
ingestedAt: '2026-10-21T21:13:32.888Z'
---

## Overview

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.

## Affected

- `sentry-javascript >= 9.36.0, < 9.47.2`
- `sentry-javascript >= 10.0.0-alpha.0, < 10.75.2`
- `sentry-javascript >= 11.0.0-alpha.0, < 11.0.0-rc.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.