Sentry Javascript
Monthly
Authorization bypass in the Sentry Next.js SDK affects @sentry/nextjs from 9.36.0 before 9.47.2, 10.x before 10.75.2, and 11.0.0-rc.1 when the webpack integration is used with a configured tunnelRoute. An unauthenticated remote request can reach an application route that collides with the tunnel path, or resolves through a root dynamic segment, without the middleware authorization that would otherwise run; exploitation additionally requires a webpack build, a colliding route, and middleware being the sole authorization control. The flaw is fixed in 9.47.2, 10.75.2, and 11.0.0-rc.1, and no public exploit was identified at time of analysis.
Authorization bypass in the Sentry Next.js SDK affects @sentry/nextjs from 9.36.0 before 9.47.2, 10.x before 10.75.2, and 11.0.0-rc.1 when the webpack integration is used with a configured tunnelRoute. An unauthenticated remote request can reach an application route that collides with the tunnel path, or resolves through a root dynamic segment, without the middleware authorization that would otherwise run; exploitation additionally requires a webpack build, a colliding route, and middleware being the sole authorization control. The flaw is fixed in 9.47.2, 10.75.2, and 11.0.0-rc.1, and no public exploit was identified at time of analysis.