CVE-2023-46729

Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

At a glance

Severity: CRITICAL 9.3
EPSS: EPSS 0.63 % · percentile 50 (2026-10-27)
State: PUBLISHED
Published: 2023-11-10
Updated: 2024-09-03
Assigner: GitHub_M
NVD status: Modified

Description

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	GitHub_M
CVSS 3.1	CRITICAL 9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-918

Advisories

GHSA-2rmr-xw8m-22q9 — Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

European references

ENISA EUVD · EUVD-2023-2851
GCVE · GCVE-0-2023-46729

Affected configurations (NVD CPE)

cpe:2.3:a:sentry:sentry_software_development_kit:*:*:*:*:*:next.js:*:* ≥ 7.26.0 < 7.77.0

Affected products

Product	Versions
getsentry · sentry-javascript	affected >= 7.26.0, < 7.77.0

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD