#nextjs

Deep Dive

Sentry rates CVE-2026-114139 as Critical, CVSS v4.0 9.1: the @sentry/nextjs SDK skips the application middleware for every path under a configured tunnelRoute on webpack builds, while the tunnel rewrite serves only the exact tunnel path, so an unauthenticated request can reach a route under the tunnel path without middleware authorization. Affected are @sentry/nextjs 9.36.0 to 9.47.1, 10.x before 10.75.2 and 11.0.0 prereleases before 11.0.0-rc.1. Fixed in 9.47.2, 10.75.2 and 11.0.0-rc.1; no exploitation in the wild is known.