Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

Description

An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user.

Recommendation

Update the @sentry/nextjs package to the latest compatible version. Followings are version details:

Affected version(s): >= 7.26.0, < 7.77.0
Patched version(s): 7.77.0

References

GHSA-2rmr-xw8m-22q9
blog.sentry.io
docs.sentry.io
www.npmjs.com
CVE-2023-46729
CWE-918
CAPEC-310
OWASP 2021-A10
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint and gives you actionable findings to investigate.

Start a free scan

Related Issues

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint - CVE-2026-42281
Sentry's Astro SDK vulnerable to ReDoS - CVE-2023-50249
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes - CVE-2023-48219

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated November 17, 2023