{"id":"GHSA-6465-jgvq-jhgp","summary":"Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`","details":"### Impact\nIn version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When `sendDefaultPii: true` was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.\n\nSentry’s server-side scrubbing (handled by Sentry's Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.\n\nUsers may be impacted if:\n\n1. Their Sentry SDK configuration has `sendDefaultPii` set to `true`\n2. Their application uses one of the Node.js Sentry SDKs with version from `10.11.0` to `10.26.0` inclusively:\n- @sentry/astro\n- @sentry/aws-serverless\n- @sentry/bun\n- @sentry/google-cloud-serverless\n- @sentry/nestjs\n- @sentry/nextjs\n- @sentry/node\n- @sentry/node-core\n- @sentry/nuxt\n- @sentry/remix\n- @sentry/solidstart\n- @sentry/sveltekit\n\nUsers can check if their project was affected, by visiting Explore → Traces and searching for “http.request.header.authorization”, “http.request.header.cookie” or similar. Any potentially sensitive values will be specific to users' applications and configurations.\n\n### Patches\nThe issue has been patched in all Sentry JavaScript SDKs starting from the [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) version.\n\n### Workarounds\nSentry strongly encourage customers to upgrade the SDK to the latest available version, [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) or later.\nIf it is not possible, consider setting `sendDefaultPii: false` to avoid unintentionally sending sensitive headers. See [here](https://docs.sentry.io/platforms/javascript/guides/node/#step-2-configure) for documentation.\n\n### Resources\n* https://develop.sentry.dev/sdk/expected-features/data-handling/#sensitive-data\n* https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0\n* https://github.com/getsentry/sentry-javascript/pull/17475\n* https://docs.sentry.io/platforms/javascript/guides/node/data-management/data-collected/#cookies","aliases":["CVE-2025-65944"],"modified":"2026-08-07T08:12:16.735936479Z","published":"2025-11-24T21:52:45Z","database_specific":{"nvd_published_at":"2025-11-25T01:15:46Z","cwe_ids":["CWE-201"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-11-24T21:52:45Z"},"references":[{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65944"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/pull/17475"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/pull/18311"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"},{"type":"PACKAGE","url":"https://github.com/getsentry/sentry-javascript"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0"}],"affected":[{"package":{"name":"@sentry/node","ecosystem":"npm","purl":"pkg:npm/%40sentry/node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/astro","ecosystem":"npm","purl":"pkg:npm/%40sentry/astro"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/aws-serverless","ecosystem":"npm","purl":"pkg:npm/%40sentry/aws-serverless"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/bun","ecosystem":"npm","purl":"pkg:npm/%40sentry/bun"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/google-cloud-serverless","ecosystem":"npm","purl":"pkg:npm/%40sentry/google-cloud-serverless"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/nestjs","ecosystem":"npm","purl":"pkg:npm/%40sentry/nestjs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/nextjs","ecosystem":"npm","purl":"pkg:npm/%40sentry/nextjs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/node-core","ecosystem":"npm","purl":"pkg:npm/%40sentry/node-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/nuxt","ecosystem":"npm","purl":"pkg:npm/%40sentry/nuxt"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/remix","ecosystem":"npm","purl":"pkg:npm/%40sentry/remix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/solidstart","ecosystem":"npm","purl":"pkg:npm/%40sentry/solidstart"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}},{"package":{"name":"@sentry/sveltekit","ecosystem":"npm","purl":"pkg:npm/%40sentry/sveltekit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.27.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6465-jgvq-jhgp/GHSA-6465-jgvq-jhgp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L"}]}