Is CVE-2025-65944 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65944 being exploited in the wild.

How severe is CVE-2025-65944?

Medium severity, with a CVSS score of 4, published 25 November 2025.

Which products and versions are affected?

@sentry/astro (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/aws-serverless (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/bun (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/google-cloud-serverless (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; and 8 more.

Is there a fix for CVE-2025-65944?

Yes. @sentry/astro (npm): upgrade to 10.27.0 or later; @sentry/aws-serverless (npm): upgrade to 10.27.0 or later; @sentry/bun (npm): upgrade to 10.27.0 or later; @sentry/google-cloud-serverless (npm): upgrade to 10.27.0 or later; @sentry/nestjs (npm): upgrade to 10.27.0 or later; @sentry/nextjs (npm): upgrade to 10.27.0 or later; @sentry/node (npm): upgrade to 10.27.0 or later; @sentry/node-core (npm): upgrade to 10.27.0 or later; @sentry/nuxt (npm): upgrade to 10.27.0 or later; @sentry/remix (npm): upgrade to 10.27.0 or later; @sentry/solidstart (npm): upgrade to 10.27.0 or later; @sentry/sveltekit (npm): upgrade to 10.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65944 attacked?

It is attacked over the network.

Am I affected by CVE-2025-65944?

Check whether you run @sentry/astro (npm), @sentry/aws-serverless (npm), @sentry/bun (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65944: Sentry JavaScript SDKs sensitive header leakage in traces

CVE-2025-65944 · Severity: medium · CVSS 4 · Published 2025-11-25

Sentry's error tracking SDK for Node.js and related JavaScript runtimes leaks sensitive HTTP headers (such as Authorization and Cookie) when a configuration option to include personally identifiable information is enabled. This means authentication credentials and session tokens could be exposed in traces sent to Sentry's monitoring platform, potentially allowing attackers with access to Sentry to hijack user sessions or impersonate authenticated users.

Technologies: @sentry/astro (npm), @sentry/nextjs (npm). Vendors: npm.

Quick answers

Is CVE-2025-65944 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65944 being exploited in the wild.
How severe is CVE-2025-65944?: Medium severity, with a CVSS score of 4, published 25 November 2025.
Which products and versions are affected?: @sentry/astro (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/aws-serverless (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/bun (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; @sentry/google-cloud-serverless (npm) SEMVER:introduced=10.11.0,fixed=10.27.0; and 8 more.
Is there a fix for CVE-2025-65944?: Yes. @sentry/astro (npm): upgrade to 10.27.0 or later; @sentry/aws-serverless (npm): upgrade to 10.27.0 or later; @sentry/bun (npm): upgrade to 10.27.0 or later; @sentry/google-cloud-serverless (npm): upgrade to 10.27.0 or later; @sentry/nestjs (npm): upgrade to 10.27.0 or later; @sentry/nextjs (npm): upgrade to 10.27.0 or later; @sentry/node (npm): upgrade to 10.27.0 or later; @sentry/node-core (npm): upgrade to 10.27.0 or later; @sentry/nuxt (npm): upgrade to 10.27.0 or later; @sentry/remix (npm): upgrade to 10.27.0 or later; @sentry/solidstart (npm): upgrade to 10.27.0 or later; @sentry/sveltekit (npm): upgrade to 10.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65944 attacked?: It is attacked over the network.
Am I affected by CVE-2025-65944?: Check whether you run @sentry/astro (npm), @sentry/aws-serverless (npm), @sentry/bun (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sentry/astro (npm): upgrade to 10.27.0 or later
```
npm install @sentry/astro@10.27.0
```
@sentry/aws-serverless (npm): upgrade to 10.27.0 or later
```
npm install @sentry/aws-serverless@10.27.0
```
@sentry/bun (npm): upgrade to 10.27.0 or later
```
npm install @sentry/bun@10.27.0
```
@sentry/google-cloud-serverless (npm): upgrade to 10.27.0 or later
```
npm install @sentry/google-cloud-serverless@10.27.0
```
@sentry/nestjs (npm): upgrade to 10.27.0 or later
```
npm install @sentry/nestjs@10.27.0
```
@sentry/nextjs (npm): upgrade to 10.27.0 or later
```
npm install @sentry/nextjs@10.27.0
```
@sentry/node (npm): upgrade to 10.27.0 or later
```
npm install @sentry/node@10.27.0
```
@sentry/node-core (npm): upgrade to 10.27.0 or later
```
npm install @sentry/node-core@10.27.0
```
@sentry/nuxt (npm): upgrade to 10.27.0 or later
```
npm install @sentry/nuxt@10.27.0
```
@sentry/remix (npm): upgrade to 10.27.0 or later
```
npm install @sentry/remix@10.27.0
```
@sentry/solidstart (npm): upgrade to 10.27.0 or later
```
npm install @sentry/solidstart@10.27.0
```
@sentry/sveltekit (npm): upgrade to 10.27.0 or later
```
npm install @sentry/sveltekit@10.27.0
```

Technical details

This vulnerability is an information disclosure (CWE-201) in Sentry's JavaScript SDKs versions 10.11.0 through 10.26.0. When the `sendDefaultPii` option is set to `true`, the SDK incorrectly includes sensitive HTTP request headers (Authorization, Cookie, etc.) as span attributes in distributed traces. The root cause is in how the SDK collects request data for trace context in Node.js applications. The server-side Relay proxy that normally scrubs sensitive data also failed to redact these headers because it used the same flawed matching logic. An attacker with access to Sentry (or an insider threat) can discover these headers by querying the Traces interface. The vulnerability is patched in version 10.27.0 and later across all affected SDKs (@sentry/node, @sentry/nextjs, @sentry/nestjs, @sentry/astro, @sentry/aws-serverless, @sentry/bun, @sentry/google-cloud-serverless, @sentry/nuxt, @sentry/remix, @sentry/solidstart, @sentry/sveltekit, and @sentry/node-core).

Affected products

Sentry @sentry/node 10.11.0 to 10.26.0
Sentry @sentry/astro 10.11.0 to 10.26.0
Sentry @sentry/aws-serverless 10.11.0 to 10.26.0
Sentry @sentry/bun 10.11.0 to 10.26.0
Sentry @sentry/google-cloud-serverless 10.11.0 to 10.26.0
Sentry @sentry/nestjs 10.11.0 to 10.26.0
Sentry @sentry/nextjs 10.11.0 to 10.26.0
Sentry @sentry/node-core 10.11.0 to 10.26.0
Sentry @sentry/nuxt 10.11.0 to 10.26.0
Sentry @sentry/remix 10.11.0 to 10.26.0
Sentry @sentry/solidstart 10.11.0 to 10.26.0
Sentry @sentry/sveltekit 10.11.0 to 10.26.0

Identifiers

CVE-2025-65944
GHSA-6465-jgvq-jhgp

Timeline

2025-11-24: disclosed: Advisory published as GHSA-6465-jgvq-jhgp
2025-11-24: patched: Patched in version 10.27.0 and later across all affected Sentry JavaScript SDKs

References

https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.