CVE-2026-114139: Sentry-Javascript: Middleware Bypass when using Tunnel route
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@sentry/nextjsto a version that resolves this vulnerability.Fixed in 9.47.2
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Exposure requires all of the following: a configured tunnelRoute, a webpack build, an application route that directly collides with the tunnel path or is resolved beneath it through a root dynamic segment, and middleware as the only authorization control. Applications without these conditions are not described as affected.
What can an unauthenticated attacker access?
An attacker can reach a colliding application route without the authorization normally enforced by application middleware. The tunnel rewrite itself serves only the exact tunnel path when valid o and p query parameters are supplied; the broader middleware skip is what creates the risk for colliding routes.
How can I check whether my application is affected?
Review the configured tunnelRoute and identify application routes that equal that path or could resolve beneath it through a root dynamic segment. Then verify whether those routes rely solely on middleware for authorization and whether the application uses a webpack build.
What should be done if an immediate upgrade is not possible?
Remove the route collision, change or remove the tunnelRoute, or ensure affected routes have authorization controls beyond middleware. Upgrade @sentry/nextjs to 9.47.2, 10.75.2, or 11.0.0-rc.1 when possible.