Answer in brief
CVE-2026-114139 records a Critical severity (CVSS 9.1) vulnerability in Sentry-Javascript: Middleware Bypass when using Tunnel route. The current sources do not mark it as known exploited. The current feed maps getsentry/sentry-javascript (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getsentry/sentry-javascript (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getsentry/sentry-javascriptgeneric | >=9.36.0 <9.47.2 || >=10.0.0-alpha.0 <10.75.2 || >=11.0.0-alpha.0 <11.0.0-rc.1 | 9.47.2, 10.75.2, 11.0.0-rc.1 |
Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
Quoted source text, attributed separately from HOL analysis.