Potential DoS when using ContextLines integration
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact The [ContextLines integration](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/contextlines/) uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing events. The stream was not explicitly closed after use. This could lead to excessive amounts of file handles open on the system and potentially lead to a Denial of Service (DoS). The ContextLines integration is enabled by default in the Node SDK (`@sentry/node`) and SDKs that run in Node.js environments (`@sentry/astro`, `@sentry/aws-serverless`, `@sentry/bun`, `@sentry/google-cloud-serverless`, `@sentry/nestjs`, `@sentry/nextjs`, `@sentry/nuxt`, `@sentry/remix`, `@sentry/solidstart`, `@sentry/sveltekit`). ### Patches Users should upgrade to version `8.49.0` or higher. ### Workarounds To remediate this issue in affected versions without upgrading to version `8.49.0` and above you can disable the ContextLines integration. See the [docs](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/#removing-a-default-integration) for more details. ```js Sentry.init({ // ... integrations: function (integrations) { // integrations will be all default integrations return integrations.filter(function (integration) { return integration.name !== "ContextLines"; }); }, }); ``` If you disable the ContextLines integration, you will lose source context on your error events. ### References - Reported issue: https://github.com/getsentry/sentry-javascript/issues/14892 - PR Fix: https://github.com/getsentry/sentry-javascript/pull/14997
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @sentry/node (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/astro (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/aws-serverless (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/bun (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/google-cloud-serverless (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/nestjs (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/nextjs (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/nuxt (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/remix (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/solidstart (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
| — | @sentry/sveltekit (npm) | 8.10.0 to before 8.49.0 | 8.49.0 | Patch available | GHSA-r5w7-f542-q2j4 |
- @sentry/node (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/astro (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/aws-serverless (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/bun (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/google-cloud-serverless (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/nestjs (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/nextjs (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/nuxt (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/remix (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/solidstart (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
- @sentry/sveltekit (npm) Vendor— Affected 8.10.0 to before 8.49.0 Fixed in 8.49.0 Patch available GHSA-r5w7-f542-q2j4
Remediation
- Fix · GHSA-r5w7-f542-q2j4 @sentry/node (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/astro (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/aws-serverless (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/bun (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/google-cloud-serverless (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/nestjs (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/nextjs (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/nuxt (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/remix (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/solidstart (npm) Fixed in 8.49.0 Advisory →
- Fix · GHSA-r5w7-f542-q2j4 @sentry/sveltekit (npm) Fixed in 8.49.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-r5w7-f542-q2j4
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences