GCVE - cpe:2.3:a:getsentry:sentry-javascript:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:getsentry:sentry-javascript:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Getsentry (`15a72c39-e970-572b-a1f7-7c54bad269e6`)
Product	Sentry Javascript (`b3c3f4b7-b3af-511d-9999-79db44e46037`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-65944`	vulnerable	2026-06-08 07:39:21.082627	Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true` Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0. Published: 2025-11-25T00:23:53.215Z Updated: 2025-11-25T14:33:37.980Z Open on db.gcve.eu Reference links https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp https://github.com/getsentry/sentry-javascript/pull/17475 https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539 https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-50249`	vulnerable	2026-06-08 06:16:15.744075	Sentry's Astro SDK vulnerable to ReDoS HIGH (7.5) Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive computation times on the server, leading to denial of service (DoS). This vulnerability has been patched in sentry/astro version 7.87.0. Published: 2023-12-20T13:53:00.512Z Updated: 2024-08-02T22:09:49.793Z Open on db.gcve.eu Reference links https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72 https://github.com/getsentry/sentry-javascript/pull/9815 https://github.com/getsentry/sentry-javascript/commit/fe24eb5eefa9d27b14b2b6f9ebd1debca1c208fb	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-46729`	vulnerable	2026-06-08 06:14:23.051173	Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CRITICAL (9.3) sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0. Published: 2023-11-10T00:57:15.611Z Updated: 2024-09-03T17:44:32.064Z Open on db.gcve.eu Reference links https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9 https://github.com/getsentry/sentry-javascript/pull/9415 https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.