Middleware Authorization Bypass

🗓️ 23 Oct 2026 05:24:09Reported by Veracode Vulnerability DatabaseType

Unauthenticated authorization bypass in @sentry/nextjs via tunnelRoute middleware skipping.

Reporter	Title	Published	Views	Family All 46
Chainguard	CVE-2026-114139 vulnerabilities	23 Oct 202614:55	–	cgr
Circl	CVE-2026-114139	21 Oct 202620:26	–	circl
CNNVD	Sentry processing logic error vulnerability	21 Oct 202600:00	–	cnnvd
CVE	CVE-2026-114139	21 Oct 202620:14	–	cve
Cvelist	CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route	21 Oct 202620:14	–	cvelist
EUVD	EUVD-2026-107549	22 Oct 202615:55	–	euvd
Github Security Blog	Sentry-Javascript: Middleware Bypass when using Tunnel route	22 Oct 202615:55	–	github
Mend	CVE-2026-114139	21 Oct 202620:14	–	mend
NVD	CVE-2026-114139	21 Oct 202621:17	–	nvd
osv_cga	CGA-24PM-83JF-CWCQ	22 Oct 202621:38	–	osv_cga

Vulners

Node

clerk @sentry/nextjsRange11.0.0-alpha.0–11.0.0-rc.0js

clerk @sentry/nextjsRange9.36.0–9.47.1js

clerk @sentry/nextjsRange10.0.0-alpha.0–10.75.1js

Source	Link
github	www.github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae
github	www.github.com/getsentry/sentry-javascript/releases/tag/9.47.2
github	www.github.com/getsentry/sentry-javascript/pull/24760
github	www.github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5
github	www.github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55
github	www.github.com/getsentry/sentry-javascript/releases/tag/10.75.2
github	www.github.com/getsentry/sentry-javascript/pull/24565
github	www.github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532
github	www.github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1
github	www.github.com/getsentry/sentry-javascript/pull/24499

29 Oct 2026 09:21Current

6Medium risk

Vulners AI Score6

CVSS 49.1

EPSS0.0051

SSVC