Executive brief
Sentry's error tracking SDK for Node.js and related JavaScript runtimes leaks sensitive HTTP headers (such as Authorization and Cookie) when a configuration option to include personally identifiable information is enabled. This means authentication credentials and session tokens could be exposed in traces sent to Sentry's monitoring platform, potentially allowing attackers with access to Sentry to hijack user sessions or impersonate authenticated users.
Technical details
This vulnerability is an information disclosure (CWE-201) in Sentry's JavaScript SDKs versions 10.11.0 through 10.26.0. When the `sendDefaultPii` option is set to `true`, the SDK incorrectly includes sensitive HTTP request headers (Authorization, Cookie, etc.) as span attributes in distributed traces. The root cause is in how the SDK collects request data for trace context in Node.js applications. The server-side Relay proxy that normally scrubs sensitive data also failed to redact these headers because it used the same flawed matching logic. An attacker with access to Sentry (or an insider threat) can discover these headers by querying the Traces interface. The vulnerability is patched in version 10.27.0 and later across all affected SDKs (@sentry/node, @sentry/nextjs, @sentry/nestjs, @sentry/astro, @sentry/aws-serverless, @sentry/bun, @sentry/google-cloud-serverless, @sentry/nuxt, @sentry/remix, @sentry/solidstart, @sentry/sveltekit, and @sentry/node-core).
Affected products
- Sentry @sentry/node 10.11.0 to 10.26.0
- Sentry @sentry/astro 10.11.0 to 10.26.0
- Sentry @sentry/aws-serverless 10.11.0 to 10.26.0
- Sentry @sentry/bun 10.11.0 to 10.26.0
- Sentry @sentry/google-cloud-serverless 10.11.0 to 10.26.0
- Sentry @sentry/nestjs 10.11.0 to 10.26.0
- Sentry @sentry/nextjs 10.11.0 to 10.26.0
- Sentry @sentry/node-core 10.11.0 to 10.26.0
- Sentry @sentry/nuxt 10.11.0 to 10.26.0
- Sentry @sentry/remix 10.11.0 to 10.26.0
- Sentry @sentry/solidstart 10.11.0 to 10.26.0
- Sentry @sentry/sveltekit 10.11.0 to 10.26.0
Timeline
- 2025-11-24: disclosed: Advisory published as GHSA-6465-jgvq-jhgp
- 2025-11-24: patched: Patched in version 10.27.0 and later across all affected Sentry JavaScript SDKs