Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 11

Description

In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When sendDefaultPii: true was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.

Recommendation

Update the @sentry/node-core package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.11.0, < 10.27.0
• Patched version(s): 10.27.0

References

• GHSA-6465-jgvq-jhgp
• CVE-2025-65944
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 10 - CVE-2025-65944
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

@sentry/node-core