| Package | Affected versions | Patched versions |
|---|---|---|
| sentry software development kit | ≥ 7.26.0, < 7.77.0 | 7.77.0 |
| @sentry/nextjs | ≥ 7.26.0, < 7.77.0 | 7.77.0 |
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
This issue only affects users who have Next.js SDK tunneling feature enabled.
The problem has been fixed in sentry/[email protected]
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free