{"id":"GHSA-6465-jgvq-jhgp","revision":"5f341381f09f4ce1ad6bfcdb718b76e7","records":[{"revision":"5f341381f09f4ce1ad6bfcdb718b76e7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6465-jgvq-jhgp","aliases":["CVE-2025-65944"],"title":"Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`","description":"### Impact\nIn version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When `sendDefaultPii: true` was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.\n\nSentry’s server-side scrubbing (handled by Sentry's Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.\n\nUsers may be impacted if:\n\n1. Their Sentry SDK configuration has `sendDefaultPii` set to `true`\n2. Their application uses one of the Node.js Sentry SDKs with version from `10.11.0` to `10.26.0` inclusively:\n- @sentry/astro\n- @sentry/aws-serverless\n- @sentry/bun\n- @sentry/google-cloud-serverless\n- @sentry/nestjs\n- @sentry/nextjs\n- @sentry/node\n- @sentry/node-core\n- @sentry/nuxt\n- @sentry/remix\n- @sentry/solidstart\n- @sentry/sveltekit\n\nUsers can check if their project was affected, by visiting Explore → Traces and searching for “http.request.header.authorization”, “http.request.header.cookie” or similar. Any potentially sensitive values will be specific to users' applications and configurations.\n\n### Patches\nThe issue has been patched in all Sentry JavaScript SDKs starting from the [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) version.\n\n### Workarounds\nSentry strongly encourage customers to upgrade the SDK to the latest available version, [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) or later.\nIf it is not possible, consider setting `sendDefaultPii: false` to avoid unintentionally sending sensitive headers. See [here](https://docs.sentry.io/platforms/javascript/guides/node/#step-2-configure) for documentation.\n\n### Resources\n* https://develop.sentry.dev/sdk/expected-features/data-handling/#sensitive-data\n* https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0\n* https://github.com/getsentry/sentry-javascript/pull/17475\n* https://docs.sentry.io/platforms/javascript/guides/node/data-management/data-collected/#cookies","state":0,"publishedAt":"2025-11-24T21:52:45+00:00","modifiedAt":"2026-08-07T08:12:16.7359365+00:00","affected":[{"ecosystem":"npm","name":"@sentry/node","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/astro","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/aws-serverless","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/bun","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/google-cloud-serverless","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/nestjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/nextjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/node-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/nuxt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/remix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/solidstart","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@sentry/sveltekit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0"},{"kind":"fixed","version":"10.27.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp","https://nvd.nist.gov/vuln/detail/CVE-2025-65944","https://github.com/getsentry/sentry-javascript/pull/17475","https://github.com/getsentry/sentry-javascript/pull/18311","https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539","https://github.com/getsentry/sentry-javascript","https://github.com/getsentry/sentry-javascript/releases","https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0","https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0"],"sourceUrl":"https://github.com/advisories/GHSA-6465-jgvq-jhgp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6465-jgvq-jhgp","identifiers":["GHSA-6465-jgvq-jhgp","CVE-2025-65944"]},"retained":false,"historicalAffected":[]}],"coverage":[]}