Description
The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.
Recommendation
Update the @sentry/nextjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 11.0.0-alpha.0, < 11.0.0-rc.1 >= 10.0.0-alpha.0, < 10.75.2 >= 9.36.0, < 9.47.2** Patched version(s): **11.0.0-rc.1 10.75.2 9.47.2**
References
Could your website be exposed too?
SmartScanner can check your website for Sentry-Javascript: Middleware Bypass when using Tunnel route and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/nextjs - CVE-2026-41248
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/shared - CVE-2026-41248
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - CVE-2026-41248
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro - CVE-2026-41248
You might also like:
See something that needs correcting? Let us knowUpdated October 22, 2026