## Sentry-Javascript: Middleware Bypass when using Tunnel route

- 種別: advisory
- 重大度: critical
- 関連技術: nodejs, nextjs, sentry
- CVE: CVE-2026-114139
- 公開日時: 2026-10-22T15:55:07.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-mchm-gjx6-7h55)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-mchm-gjx6-7h55

影響: npm:@sentry/nextjs >= 9.36.0, < 9.47.2 → 9.47.2, npm:@sentry/nextjs >= 10.0.0-alpha.0, < 10.75.2 → 10.75.2, npm:@sentry/nextjs >= 11.0.0-alpha.0, < 11.0.0-rc.1 → 11.0.0-rc.1
The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the o and p parameters set. The skip applied to anything under the tunnel pa…