Sensitive Information Disclosure

🗓️ 13 Jan 2026 08:00:37Reported by Veracode Vulnerability DatabaseType

Sentry-Javascript over-collects headers when sendDefaultPii is enabled, exposing Cookie data in traces.

Reporter	Title	Published	Views	Family All 23
Chainguard	CVE-2025-65944 vulnerabilities	28 Nov 202501:29	–	cgr
Circl	CVE-2025-65944	25 Nov 202504:02	–	circl
CNNVD	Sentry 安全漏洞	25 Nov 202500:00	–	cnnvd
CVE	CVE-2025-65944	25 Nov 202500:23	–	cve
Cvelist	CVE-2025-65944 Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`	25 Nov 202500:23	–	cvelist
EUVD	EUVD-2025-198990	25 Nov 202500:23	–	euvd
Github Security Blog	Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`	24 Nov 202521:52	–	github
NVD	CVE-2025-65944	25 Nov 202501:15	–	nvd
OSV	CGA-2RX3-JCX9-JQC3	29 Jan 202600:42	–	osv
OSV	GHSA-6465-JGVQ-JHGP Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`	24 Nov 202521:52	–	osv

Vulners

Node

astro @sentry/astroRange10.11.0–10.26.0js

bun @sentry/bunRange10.11.0–10.26.0js

nestjs @sentry/nestjsRange10.11.0–10.26.0js

clerk @sentry/nextjsRange10.11.0–10.26.0js

node @sentry/nodeRange10.11.0–10.26.0js

remix @sentry/remixRange10.11.0–10.26.0js

nuxt @sentry/nuxtRange10.11.0–10.26.0js

Source	Link
github	www.github.com/getsentry/sentry-javascript/commit/6ce620e983814a263eb036a3ee79f80e780a880a
github	www.github.com/getsentry/sentry-javascript/releases/tag/10.27.0
github	www.github.com/getsentry/sentry-javascript/pull/18311
github	www.github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp
github	www.github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539
github	www.github.com/getsentry/sentry-javascript/releases/tag/10.11.0
github	www.github.com/getsentry/sentry-javascript/pull/17475

14 Jan 2026 14:34Current

6.8Medium risk

Vulners AI Score6.8

CVSS 45

EPSS0.00334

SSVC