CVE-2026-114139

{
  "etk_id": "ETK-2026-2356",
  "cve_id": "CVE-2026-114139",
  "display_id": "CVE-2026-114139",
  "ghsa_id": "GHSA-mchm-gjx6-7h55",
  "euvd_id": "EUVD-2026-107549",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Middleware authorization bypass in Sentry JavaScript webpack integration",
  "summary": "Sentry JavaScript applications using the webpack integration are affected when a configured tunnel route overlaps an application route. An unauthenticated requester may reach the overlapping route without its middleware authorization checks if the application relies solely on that middleware for access control.",
  "mitigation": "Upgrade sentry-javascript to 9.47.2, 10.75.2, or 11.0.0-rc.1, as appropriate for your release line. Until upgraded, remove or change tunnel-route and application-route collisions and enforce authorization beyond middleware alone.",
  "vendor": "getsentry",
  "product": "sentry-javascript",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.36.0, <= 9.47.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        ">= 9.47.2",
        "< 10.0.0-alpha.0"
      ],
      "package_name": "@sentry/nextjs",
      "purl": "pkg:npm/@sentry/nextjs"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 10.0.0-alpha.0, <= 10.75.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        ">= 10.75.2",
        "< 11.0.0-alpha.0"
      ],
      "package_name": "@sentry/nextjs",
      "purl": "pkg:npm/@sentry/nextjs"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.0.0-alpha.0, <= 11.0.0-rc.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        ">= 11.0.0-rc.1"
      ],
      "package_name": "@sentry/nextjs",
      "purl": "pkg:npm/@sentry/nextjs"
    }
  ],
  "cwes": [
    693
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 12.6289063,
  "t0_at": "2026-10-21T20:14:34.419000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T21:09:13.362990+00:00",
      "days": 0.037950740625,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T20:14:34.419000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-21T20:14:34.419000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T20:14:34.419000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114139"
    }
  }
}