CVE-2026-114139 getsentry CVE debrief

Who should care

Defenders who use the @sentry/nextjs package and have the `tunnelRoute` option set should verify if their application is built with webpack and if any route of their application resolves under the tunnel path. They should also prioritize updating to a fixed version of @sentry/nextjs.

Why it matters

CVE-2026-114139 is a vulnerability in the @sentry/nextjs package that allows for a middleware bypass when using the tunnel route. Defenders should prioritize verifying if their application is built with webpack and if the `tunnelRoute` option is set. They should also check if any route of their application resolves under the tunnel path and update to a fixed version of @sentry/nextjs.

• Verify if the application is built with webpack and if the `tunnelRoute` option is set.
• Check if any route of the application resolves under the tunnel path.
• Update to a fixed version of @sentry/nextjs (9.47.2, 10.75.2, or 11.0.0-rc.1).

Technical summary

The vulnerability occurs when the `tunnelRoute` option is set, the app is built with webpack, and some route of the application resolves under the tunnel path. This can cause requests to go to the application instead of Sentry, and the middleware never runs on them. However, skipping middleware does not grant the request any privileges. Defenders should prioritize verifying if their application is built with webpack and if the `tunnelRoute` option is set. They should also check if any route of their application resolves under the tunnel path and update to a fixed version of @sentry/nextjs.

Defensive priority

Defenders should prioritize verifying if their application is built with webpack and if the `tunnelRoute` option is set. They should also check if any route of their application resolves under the tunnel path.

Recommended defensive actions

• Verify if the application is built with webpack and if the `tunnelRoute` option is set.
• Check if any route of the application resolves under the tunnel path.
• Update to a fixed version of @sentry/nextjs (9.47.2, 10.75.2, or 11.0.0-rc.1).
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The evidence for this vulnerability comes from the official CVE Program record, the NVD vulnerability detail page, and the source item from osv_dev. The source item provides detailed information about the vulnerability, including the impact, affected versions, and fixed versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.