CVE-2023-46729: Sentry Next.js SSRF Vulnerability
Summary
CVE-2023-46729: Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint. Affects @sentry/nextjs versions >= 7.26.0, < 7.77.0. Fixed in 7.77.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Sentry Next.js is an open-source error tracking tool designed for Next.js applications. It provides developers with the ability to monitor and debug errors in their applications. The Next.js SDK tunneling feature allows users to configure tunneling to avoid ad-blockers. However, an unsanitized input in the Next.js SDK tunnel endpoint can lead to a Server-Side Request Forgery (SSRF) vulnerability.
Vulnerability Detail
The SSRF vulnerability in Sentry Next.js allows an attacker to send HTTP requests to arbitrary URLs and reflect the response back to the user. This can result in various attack vectors, including client-side vulnerabilities such as XSS/CSRF, interaction with internal networks, reading cloud metadata endpoints (AWS, Azure, Google Cloud, etc.), and local/remote port scanning. It is important to note that this vulnerability only affects users who have enabled the Next.js SDK tunneling feature.
How To Fix
Latest published version: 11.8.0 as of 23 Oct 2026
npm install @sentry/nextjs@11.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.77.0
This is the first release that contains the fix.
npm install @sentry/nextjs@7.77.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, users can disable tunneling by removing the tunnelRoute option from the Sentry Next.js SDK configuration file (next.config.js or next.config.mjs). This will prevent the SSRF vulnerability from being exploited.
Conclusion
The Sentry Next.js SSRF vulnerability allows attackers to send HTTP requests to arbitrary URLs and potentially exploit various attack vectors. It is crucial for users to update to version 7.77.0 of the @sentry/nextjs package or disable tunneling to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @sentry/nextjs →
FAQ
This vulnerability affects users who have enabled the Next.js SDK tunneling feature in their Sentry Next.js applications.
The SSRF vulnerability can lead to various attack vectors, including client-side vulnerabilities, interaction with internal networks, reading cloud metadata endpoints, and local/remote port scanning.
Users should update to version 7.77.0 of the @sentry/nextjs package. Alternatively, they can disable tunneling by removing the tunnelRoute option from the Sentry Next.js SDK configuration file.
Yes, users can disable tunneling by removing the tunnelRoute option from the Sentry Next.js SDK configuration file.
More information about this vulnerability can be found in the Sentry Next.js tunneling feature documentation and the provided references.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sentry/nextjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
