CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

The Sentry-Javascript SDK for JavaScript contains a middleware bypass vulnerability in its webpack integration for @sentry/nextjs . Versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1 are affected. The root cause is that the integration skips application middleware for all paths under a conf...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...