GHSA-fvxq-xq4h-rqgm: 
JavaScript vulnerability analysis and mitigation

Impact

With the tunnelRoute option enabled, cookies that your users' browsers send to your app were also forwarded to Sentry, including HttpOnly session cookies. If your site is behind HTTP Basic authentication, the browser's Authorization header was forwarded the same way. Sentry's ingestion does not read, store, or log Cookie headers, or Authorization headers that are not Sentry's. Those headers were not added to your events. Nothing was retained, so there is nothing to remove from your Sentry organization. Events already in your organization do not contain these headers as a result of this issue. You are affected only if all of the following are true:

• You use @sentry/nextjs from 7.26.0 through 10.76.x, or from 11.0.0 through 11.8.x.
• tunnelRoute is set, either to a path such as /monitoring or to true.
• Your DSN points at sentry.io. The SDK does not tunnel events for a self-hosted DSN.

tunnelRoute sends each browser event to a path on your own Next.js app, and your server forwards that request to Sentry, so ad blockers are less likely to block the event. The path is on your domain, so the browser attached the same cookies it attaches to any request to your app. Your server forwarded the request unchanged, headers included.

Patches

Fixed in 10.77.1 and 11.9.0:

• With tunnelRoute, browsers now send tunnel requests with credentials: 'omit' by default, so cookies are no longer attached to them. No configuration change is needed.
• A new, opt-in handler mode forwards only the event payload to Sentry, without any request headers. To enable it, add app/sentry-tunnel/route.ts:

  export { POST } from '@sentry/nextjs/tunnel';

  If your app sits behind Vercel Deployment Protection, Cloudflare Access or another login that requires cookies, tunnel requests without credentials will be rejected by that layer after upgrading. Use handler mode instead: the cookies reach your server but are not forwarded to Sentry.

Workarounds

If you can't upgrade, stop the browser from attaching credentials to tunnel requests:

Sentry.init({
  // ...
  transportOptions: { fetchOptions: { credentials: 'omit' } },
});

Alternatively, remove the tunnelRoute option.

References

• https://docs.sentry.io/platforms/javascript/guides/nextjs/configuration/build/#tunnelRoute
• Fix (credentials): https://github.com/getsentry/sentry-javascript/pull/25509, v10 backport https://github.com/getsentry/sentry-javascript/pull/25561
• Fix (handler mode): https://github.com/getsentry/sentry-javascript/pull/25456, v10 backport https://github.com/getsentry/sentry-javascript/pull/25559