@sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139)
Severity: critical · Patch status: patched · Since 2026-09-24 · CVE-2026-114139
Sentry disclosed a critical middleware bypass in @sentry/nextjs (CVE-2026-114139, CVSS 9.1). The tunnelRoute option skips Next.js middleware for requests under the tunnel path to let envelope requests reach Sentry, but the skip was broader than the rewrite, which only serves requests with o and p parameters. Requests in the gap reach the application with middleware never running, potentially bypassing middleware-only authorization. Affected only if tunnelRoute is set, the app is built with webpack (Turbopack unaffected), a route resolves under the tunnel path (direct collision or root dynamic segment like app/[locale]/…), and middleware is the sole authorization enforcement. No in-the-wild exploitation reported. Fixed in 9.47.2, 10.75.2 and 11.0.0-rc.1; the skip now matches only requests the rewrite actually serves, with no config change needed.
What to do
- Upgrade @sentry/nextjs to 9.47.2, 10.75.2, or 11.0.0-rc.1 (or later) and rebuild
- If upgrading is delayed, set tunnelRoute to a path no route can resolve under, remove the option, or build with Turbopack
- Audit routes under the tunnel path (including root dynamic segments) and enforce authorization in the route, layout, or data-access layer rather than relying solely on middleware
Fixed versions
- @sentry/nextjs 9.47.2
- @sentry/nextjs 10.75.2
- @sentry/nextjs 11.0.0-rc.1
Sources
All live incidents on Threat Watch
