Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

Description

An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user.

Recommendation

Update the @sentry/nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 7.26.0, < 7.77.0
• Patched version(s): 7.77.0

References

• GHSA-2rmr-xw8m-22q9
• blog.sentry.io
• docs.sentry.io
• www.npmjs.com
• CVE-2023-46729
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 4 - CVE-2025-65944
• Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
• Axios is vulnerable to DoS attack through lack of data size check - CVE-2025-58754
• billboard.js allows prototype pollution via the function generate - CVE-2025-49223

Tags:

npm

@sentry/nextjs