Is CVE-2026-114139 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114139 being exploited in the wild.

How severe is CVE-2026-114139?

Critical severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

@sentry/nextjs (npm) >= 9.36.0, < 9.47.2, SEMVER:introduced=9.36.0,fixed=9.47.2; Sentry-Javascript 9.36.0 to before 9.47.2, 10.0 to before 10.75.2, 11.0.0-rc.0.

Is there a fix for CVE-2026-114139?

Yes. @sentry/nextjs (npm): upgrade to 9.47.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114139 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114139?

Check whether you run @sentry/nextjs (npm) or Sentry-Javascript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114139: Sentry-JavaScript authentication bypass in webpack integration middleware

Q: Is there a fix for CVE-2026-114139?

Yes. @sentry/nextjs (npm): upgrade to 9.47.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114139 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114139?

Check whether you run @sentry/nextjs (npm) or Sentry-Javascript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114139 · Severity: critical · CVSS 4 · Published 2026-10-21

Sentry-JavaScript, which helps applications track errors and performance, contains a flaw in its webpack integration for Next.js that can bypass middleware-based authentication. When tunnel routing is configured, requests to routes that collide with the tunnel path can reach application handlers without going through authorization middleware, allowing unauthenticated access. This affects only applications using the vulnerable SDK versions with tunnelRoute configuration and middleware-only authentication.

Technologies: @sentry/nextjs (npm). Vendors: npm, Sentry.

Quick answers

Is CVE-2026-114139 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114139 being exploited in the wild.
How severe is CVE-2026-114139?: Critical severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: @sentry/nextjs (npm) >= 9.36.0, < 9.47.2, SEMVER:introduced=9.36.0,fixed=9.47.2; Sentry-Javascript 9.36.0 to before 9.47.2, 10.0 to before 10.75.2, 11.0.0-rc.0.
Is there a fix for CVE-2026-114139?: Yes. @sentry/nextjs (npm): upgrade to 9.47.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114139 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114139?: Check whether you run @sentry/nextjs (npm) or Sentry-Javascript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sentry/nextjs (npm): upgrade to 9.47.2 or later
```
npm install @sentry/nextjs@9.47.2
```

Technical details

The vulnerability exists in the @sentry/nextjs webpack integration where tunnel request matching in middleware is broader than the actual tunnel rewrite rules, causing middleware to be skipped for paths that don't actually reach Sentry. An unauthenticated attacker can craft requests to application routes that collide with or resolve under the configured tunnelRoute to bypass middleware authorization checks. The flaw affects versions 9.36.0 through 9.47.1, 10.0 through 10.75.1, and pre-release 11.0.0 before rc.1.

Affected products

Sentry sentry-javascript 9.36.0 to before 9.47.2, 10.0 to before 10.75.2, 11.0.0-rc.0

Identifiers

CVE-2026-114139
GHSA-mchm-gjx6-7h55

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.