Sentry-Javascript: Middleware Bypass when using Tunnel route

@sentry/nextjs (npm)

### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider…

First seen: 22 Oct 2026
Last update: 22 Oct 2026, 15:55 UTC
Fixed in: @sentry/nextjs 9.47.2
@sentry/nextjs 10.75.2
@sentry/nextjs 11.0.0-rc.1
Identifiers: CVE-2026-114139
CVSS: 9.1
Source: GitHub advisory
On the menu as: npm packages
Next.js

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Sentry-Javascript: Middleware Bypass when using Tunnel route
Severity: critical. Patch status: patched.
Affected: @sentry/nextjs (npm)
Fixed in: @sentry/nextjs 9.47.2, @sentry/nextjs 10.75.2, @sentry/nextjs 11.0.0-rc.1
Ids: CVE-2026-114139

### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider…

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `@sentry/nextjs`. For each hit, compare the installed version with the fix on the same major line: @sentry/nextjs 9.47.2, @sentry/nextjs 10.75.2, @sentry/nextjs 11.0.0-rc.1. If it's lower, give the exact upgrade command for the package manager this repo uses.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114139") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-mchm-gjx6-7h55 https://github.com/getsentry/sentry-javascript/pull/24499 https://github.com/getsentry/sentry-javascript/pull/24565 https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-mchm-gjx6-7h55 https://nvd.nist.gov/vuln/detail/CVE-2026-114139
https://pwned.coffee/i/sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139

Sources

Totalone very hot coffee