Denial of Service Risk in ContextLines Integration of @sentry/node Package
Summary
GHSA-r5w7-f542-q2j4: Potential DoS when using ContextLines integration. Affects @sentry/node versions >= 8.10.0, < 8.49.0. Fixed in 8.49.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sentry/node package is a JavaScript SDK designed for error tracking and performance monitoring in Node.js applications. It provides developers with tools to capture and report errors, along with contextual information to aid in debugging. One of its features, the ContextLines integration, enhances error reports by attaching source context from files. However, this integration has a vulnerability that can lead to excessive file handles being open, potentially causing a Denial of Service (DoS).
Vulnerability Detail
The vulnerability arises from the ContextLines integration not explicitly closing readable streams after use. This oversight can lead to an accumulation of open file handles on the system, which may exhaust system resources and result in a Denial of Service (DoS) condition. The ContextLines integration is enabled by default in several Node.js SDKs, making this issue particularly relevant for developers using these packages.
How To Fix
Latest published version: 11.8.0 as of 23 Oct 2026
npm install @sentry/node@11.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.49.0
This is the first release that contains the fix.
npm install @sentry/node@8.49.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can disable the ContextLines integration to mitigate the risk. Here’s how to do it in your Sentry initialization code:
Sentry.init({
// ...
integrations: function (integrations) {
// integrations will be all default integrations
return integrations.filter(function (integration) {
return integration.name !== 'ContextLines';
});
},
});
Disabling this integration will result in the loss of source context on error events.
Conclusion
The vulnerability in the ContextLines integration of the @sentry/node package poses a risk of Denial of Service due to unclosed readable streams. Users are advised to upgrade to version 8.49.0 or higher to mitigate this risk. In the meantime, disabling the integration can serve as a temporary workaround. Regular monitoring with tools like Vulert can help ensure your application remains secure.
See every vulnerability recorded for @sentry/node →
FAQ
The ContextLines integration is a feature in the Sentry SDK that attaches source context from files to error reports, helping developers understand the context in which an error occurred.
The vulnerability can lead to excessive open file handles, which may exhaust system resources and cause a Denial of Service (DoS) condition, impacting application availability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can identify if your application is affected by this vulnerability.
If an immediate upgrade is not feasible, you can disable the ContextLines integration as a temporary workaround to mitigate the risk of a DoS attack.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sentry/node.
