Read the docs
TI-2023-25212 Aliases CVE-2023-46729GHSA-2rmr-xw8m-22q9

Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

Priority MEDIUM 43CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00631 50th percentileScored 2026-11-07
Fix Fixed sentry-javascript (getsentry): 7.77.0@sentry/nextjs (npm): 7.77.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysentry-javascript7.26.0 to before 7.77.07.77.0Patch availableCNA
—@sentry/nextjs (npm)7.26.0 to before 7.77.07.77.0Patch availableGHSA-2rmr-xw8m-22q9
  • sentry-javascript Vendorgetsentry Affected 7.26.0 to before 7.77.0 Fixed in 7.77.0 Patch available CNA
  • @sentry/nextjs (npm) Vendor— Affected 7.26.0 to before 7.77.0 Fixed in 7.77.0 Patch available GHSA-2rmr-xw8m-22q9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:sentry_software_development_kit:*:*:*:*:*:next.js:*:*7.26.0 to before 7.77.0VulnerableSentry
  • cpe:2.3:a:sentry:sentry_software_development_kit:*:*:*:*:*:next.js:*:* Versions 7.26.0 to before 7.77.0 Vulnerable ·Sentry

Remediation

  • Fix · CNA sentry-javascript (getsentry) Fixed in 7.77.0
  • Fix · GHSA-2rmr-xw8m-22q9 @sentry/nextjs (npm) Fixed in 7.77.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46729
  2. 2026-10-03 Alias added: GHSA-2rmr-xw8m-22q9
  3. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 2

Other 4

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
  • TI-2026-37904 Sentry: Inefficient Regular Expression Complexity in sentry CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences