Medium severity · published Nov 10, 2023
CVE-2023-46729
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
sentry-javascript · getsentry
>= 7.26.0, < 7.77.0 · source: vendor
SS
Sentry Software Development Kit · Sentry
7.26.0 before 7.77.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46729
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46729
Patch
https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be
Patch
https://github.com/getsentry/sentry-javascript/pull/9415
Vendor Advisory
https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9
More from sentry-javascript
9.1
CVE-2026-114139
Sentry-Javascript: Middleware Bypass when using Tunnel route
7.5
CVE-2023-50249
Sentry's Astro SDK vulnerable to ReDoS
5.1
CVE-2025-65944
Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`