CVE-2026-114139: Middleware bypass in @sentry/nextjs tunnel routes
Summary
CVE-2026-114139: Certain application routes may bypass middleware authorization, allowing requests to reach routes that rely on middleware alone for access control. Affects @sentry/nextjs across 3 version ranges.
>= 9.36.0, < 9.47.2
>= 10.0.0-alpha.0, < 10.75.2
>= 11.0.0-alpha.0, < 11.0.0-rc.1
Fixed in 9.47.2, 10.75.2 or 11.0.0-rc.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
@sentry/nextjs is an npm package in the Sentry JavaScript SDK for Next.js applications. It provides Sentry monitoring integration, including an optional tunnel route that sends browser events through the application’s server. The tunnel route can be paired with a rewrite that forwards event requests to Sentry.
Vulnerability Detail
The middleware bypass can expose application routes to requests that avoid middleware authorization. In affected webpack builds, tunnelRoute causes middleware to be skipped for paths under the tunnel path, while the rewrite serves only requests to that path with the o and p parameters. Requests in the gap reach the application without middleware running. Exposure requires a route under the tunnel path and middleware as its only authorization layer; server-side session checks remain protective.
How To Fix
Latest published version: 11.8.0 as of 23 Oct 2026
npm install @sentry/nextjs@11.8.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.36.0, < 9.47.29.47.2npm install @sentry/nextjs@9.47.2 -
>= 10.0.0-alpha.0, < 10.75.210.75.2npm install @sentry/nextjs@10.75.2 -
>= 11.0.0-alpha.0, < 11.0.0-rc.111.0.0-rc.1npm install @sentry/nextjs@11.0.0-rc.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Documented workaround: For @sentry/nextjs, set tunnelRoute to a path no application route can resolve under, or remove the option. Alternatively, build with Turbopack or enforce authorization in the route, layout, or data-access path as well as middleware.
Conclusion
Upgrade to @sentry/nextjs 9.47.2 or the applicable fixed version for your release line. The issue requires a configured tunnel route, a webpack build, a route under that path, and middleware as the sole authorization layer. Server-side session checks remain protective. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for @sentry/nextjs →
FAQ
@sentry/nextjs is affected from 9.36.0 before 9.47.2, from 10.0.0-alpha.0 before 10.75.2, and from 11.0.0-alpha.0 before 11.0.0-rc.1.
CVE-2026-114139 can let requests reach application routes without middleware authorization when middleware is their only access-control layer.
Upgrade @sentry/nextjs to the minimum fixed version 9.47.2 on the 9.x release line.
For @sentry/nextjs, choose a tunnel path with no matching application routes, remove tunnelRoute, use Turbopack, or enforce authorization beyond middleware.
Check package-lock.json for @sentry/nextjs and its resolved version. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sentry/nextjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
