Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp)

Description

In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When sendDefaultPii: true was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.

Recommendation

Update the @sentry/solidstart package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.11.0, < 10.27.0
• Patched version(s): 10.27.0

References

• GHSA-6465-jgvq-jhgp
• CVE-2025-65944
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - CVE-2024-35255
• Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - CVE-2024-23331
• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection (GHSA-h4j5-c7cj-74xg) - CVE-2020-28502
• Materialize-css vulnerable to Cross-site Scripting in autocomplete component (GHSA-7752-f4gf-94gc) - CVE-2019-11003

Tags:

npm

@sentry/solidstart