{"id":"CVE-2026-114139","aliases":[],"title":"Sentry-Javascript: Middleware Bypass when using Tunnel route","titleSource":"GitHub_M","descriptionSource":"GitHub_M","products":[{"vendor":"getsentry","name":"sentry-javascript","platforms":[],"versions":[{"version":">= 9.36.0, < 9.47.2","status":"affected"},{"version":">= 10.0.0-alpha.0, < 10.75.2","status":"affected"},{"version":">= 11.0.0-alpha.0, < 11.0.0-rc.1","status":"affected"}],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-114139"}],"remediation":[],"description":"Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.","severity":"critical","score":9.1,"published":"2026-10-21T20:14:34.419Z","modified":"2026-10-28T01:38:14.177Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55","https://github.com/getsentry/sentry-javascript/pull/24499","https://github.com/getsentry/sentry-javascript/pull/24565","https://github.com/getsentry/sentry-javascript/pull/24760","https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532","https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae","https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5","https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2","https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1","https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2"],"sources":[{"name":"CVE","id":"CVE-2026-114139","modified":"2026-10-28T01:38:14.177Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114139"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.1}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:55:32.564Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}