CVE-2025-65944
November 25, 2025
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.
Affected Packages
https://github.com/getsentry/sentry-javascript.git (GITHUB):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/aws-serverless (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/node-core (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/astro (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/sveltekit (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/node (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/solidstart (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/nextjs (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/remix (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/google-cloud-serverless (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/nuxt (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/nestjs (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0@sentry/bun (NPM):
Affected version(s) >=10.11.0 <10.27.0Fix Suggestion:
Update to version 10.27.0Related Resources (9)
Do you need more information?
Contact UsCVSS v4
Base Score:
5
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
HIGH
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
LOW
Subsequent System Availability
LOW
CVSS v3
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Insertion of Sensitive Information Into Sent Data
EPSS
Base Score:
0.06
