Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2025-65944: Sentry JavaScript may expose cookies when sendDefaultPii enabled
CVE-2025-65944 · published 11 months ago
Summary
The Sentry JavaScript SDK for Node.js (versions 10.11.0 through 10.26.x) can unintentionally send sensitive HTTP headers, such as cookies, to the Sentry service when the sendDefaultPii option is turned on. Anyone with access to the Sentry account could see these values and potentially misuse them. Upgrade to version 10.27.0 or later to stop the data from being sent.
What to do
- Update sentry node to version 10.27.0.
- Update sentry astro to version 10.27.0.
- Update sentry aws-serverless to version 10.27.0.
- Update sentry bun to version 10.27.0.
- Update sentry google-cloud-serverless to version 10.27.0.
- Update sentry nestjs to version 10.27.0.
- Update sentry nextjs to version 10.27.0.
- Update sentry node-core to version 10.27.0.
- Update sentry nuxt to version 10.27.0.
- Update sentry remix to version 10.27.0.
- Update sentry solidstart to version 10.27.0.
- Update sentry sveltekit to version 10.27.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | sentry | node |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | astro |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | aws-serverless |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | bun |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | google-cloud-serverless |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | nestjs |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | nextjs |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | node-core |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | nuxt |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | remix |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | solidstart |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
| npm | sentry | sveltekit |
>= 10.11.0, < 10.27.0 Fix: upgrade to 10.27.0
|
Original advisory text
Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.
References
- https://github.com/getsentry/sentry-javascript/pull/18311
- https://github.com/getsentry/sentry-javascript/releases
- https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0
- https://github.com/advisories/GHSA-6465-jgvq-jhgp
- https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0 URL
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgv... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65944 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65944... Vendor Advisory
- https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b55... Patch
- https://github.com/getsentry/sentry-javascript/pull/17475 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.0
High
Type
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published25 Nov 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta