{"id":"CVE-2026-114139","summary":"Sentry-Javascript: Middleware Bypass when using Tunnel route","details":"Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.","aliases":["GHSA-mchm-gjx6-7h55"],"modified":"2026-10-22T10:46:12.373449784Z","published":"2026-10-21T20:14:34.419Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114139.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-693"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114139.json"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/commit/878b685c85dc12045e47e1932c96f5381d7ac532"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/commit/c122aac4f29541eb6da494296822c91eab3cf5ae"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/commit/d525a2f6015b47384bc139c30d58e0d5435d52e5"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/pull/24499"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/pull/24565"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/pull/24760"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2"},{"type":"ADVISORY","url":"https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114139"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getsentry/sentry-javascript","events":[{"introduced":"957c394d5c9ca34fe995a26b419b62c3b576cb1a"},{"fixed":"f2519e7228ce9ea4ba4fd0dd9ae6f2a9fdf68d1a"},{"introduced":"0"},{"fixed":"faeac9acabbe2fcd2d6853a04208fafda306fb68"},{"introduced":"474a5dc00011d4367e58701006ce489c2071377a"},{"fixed":"e46fccbba18924bb0af8b323c9af046289c77897"},{"fixed":"878b685c85dc12045e47e1932c96f5381d7ac532"},{"fixed":"c122aac4f29541eb6da494296822c91eab3cf5ae"},{"fixed":"d525a2f6015b47384bc139c30d58e0d5435d52e5"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"9.36.0"},{"fixed":"9.47.2"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"10.0.0-alpha.0"},{"fixed":"10.75.2"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"11.0.0-alpha.0"},{"fixed":"11.0.0-rc.1"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"878b685c85dc12045e47e1932c96f5381d7ac532"}]},{"range":[{"fixed":"c122aac4f29541eb6da494296822c91eab3cf5ae"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d525a2f6015b47384bc139c30d58e0d5435d52e5"}]},{"original_tag":"10.75.2","range":[{"fixed":"faeac9acabbe2fcd2d6853a04208fafda306fb68"}],"source":"REFERENCES_TAG"},{"original_tag":"11.0.0-rc.1","range":[{"fixed":"e46fccbba18924bb0af8b323c9af046289c77897"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"f2519e7228ce9ea4ba4fd0dd9ae6f2a9fdf68d1a"}],"source":"REFERENCES_TAG","original_tag":"9.47.2"}]}}],"versions":["5.0.5","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0","raven-node@2.6.4","raven-js@3.27.0","raven-js@3.26.4","raven-js@3.26.3","raven-node@2.6.3","3.26.2","3.26.1","3.26.0","3.25.2","3.25.1","3.25.0","3.24.2","3.24.1","3.24.0","3.23.3","3.23.2","3.23.1","3.23.0","3.22.4","3.22.3","3.22.2","3.22.1","3.22.0","3.21.0","3.20.1","3.20.0","3.19.1","3.19.0","3.18.1","3.18.0","3.17.0","3.16.0","3.14.2","3.14.1","3.14.0","3.13.1","3.13.0","3.12.1","3.12.0","3.11.0","3.10.0","3.9.2","3.9.1","3.9.0","3.8.0","3.7.0","3.6.1","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.1","3.1.0","3.0.5","3.0.4","3.0.3","3.0.2","3.0.1","3.0.0","2.3.0","2.2.0","2.1.0","2.0.0","1.3.0","1.2.0","1.1.22","1.1.21","1.1.20","1.1.19","1.1.18","1.1.17","1.1.16","1.1.15","1.1.14","1.1.13","1.1.12","1.1.11","1.1.10","1.1.9","1.1.8","1.1.7","1.1.6","1.1.5","1.1.4","1.1.3","1.1.2","1.1.1","1.1.0","1.1.0-rc4","1.1.0-rc3","1.1.0-rc2","1.1.0-rc1","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0","0.5.2","0.5.1","0.5","0.1.1","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114139.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}