cveboard RSS feed

CVE-2026-114139

GitHubCritical, npm

Sentry-Javascript: Middleware Bypass when using Tunnel route

The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.

No known exploitation
Severity
Critical, CVSS 9.1 (v4.0)
EPSS
0.41% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages