Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`
Priority LOW 23CWE-201Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-201.
Summary
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed sentry-javascript (getsentry): 10.27.0@sentry/node (npm): 10.27.0+11 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getsentry | sentry-javascript | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | CNA |
| — | @sentry/node (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/astro (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/aws-serverless (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/bun (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/google-cloud-serverless (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/nestjs (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/nextjs (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/node-core (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/nuxt (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/remix (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/solidstart (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
| — | @sentry/sveltekit (npm) | 10.11.0 to before 10.27.0 | 10.27.0 | Patch available | GHSA-6465-jgvq-jhgp |
- sentry-javascript Vendorgetsentry Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available CNA
- @sentry/node (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/astro (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/aws-serverless (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/bun (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/google-cloud-serverless (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/nestjs (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/nextjs (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/node-core (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/nuxt (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/remix (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/solidstart (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
- @sentry/sveltekit (npm) Vendor— Affected 10.11.0 to before 10.27.0 Fixed in 10.27.0 Patch available GHSA-6465-jgvq-jhgp
Remediation
- Fix · CNA sentry-javascript (getsentry) Fixed in 10.27.0
- Fix · GHSA-6465-jgvq-jhgp @sentry/node (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/astro (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/aws-serverless (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/bun (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/google-cloud-serverless (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/nestjs (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/nextjs (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/node-core (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/nuxt (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/remix (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/solidstart (npm) Fixed in 10.27.0 Advisory →
- Fix · GHSA-6465-jgvq-jhgp @sentry/sveltekit (npm) Fixed in 10.27.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-65944
- 2026-10-03 Alias added: GHSA-6465-jgvq-jhgp
References
Other 8
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp
- https://github.com/getsentry/sentry-javascript/pull/17475
- https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539
- https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
- https://github.com/getsentry/sentry-javascript/pull/18311
- https://github.com/getsentry/sentry-javascript
- https://github.com/getsentry/sentry-javascript/releases
- https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0
More getsentry vulnerabilities
- TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
- TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
- TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
- TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
- TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
- TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
Sources
- CVE-2025-65944 · CVE Program
- CVE-2025-65944 · NVD
- FIRST EPSS
- GHSA-6465-jgvq-jhgp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences