Sentry JavaScript SDK resource leak in ContextLines integration

Severity: low · CVSS 3.1 · Published 2025-01-28

Sentry's JavaScript SDKs include a ContextLines integration that adds source code context to error reports for better debugging. The integration opens file streams to read source files but fails to close them after use, potentially exhausting system file handle limits and causing the application to become unresponsive. This affects all Node.js-based SDKs and is enabled by default.

Technologies: @sentry/astro (npm), @sentry/nextjs (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 28 January 2025.
Which products and versions are affected?
@sentry/astro (npm) SEMVER:introduced=8.10.0,fixed=8.49.0; @sentry/aws-serverless (npm) SEMVER:introduced=8.10.0,fixed=8.49.0; @sentry/bun (npm) SEMVER:introduced=8.10.0,fixed=8.49.0; @sentry/google-cloud-serverless (npm) SEMVER:introduced=8.10.0,fixed=8.49.0; and 7 more.
Is there a fix for This vulnerability?
Yes. @sentry/astro (npm): upgrade to 8.49.0 or later; @sentry/aws-serverless (npm): upgrade to 8.49.0 or later; @sentry/bun (npm): upgrade to 8.49.0 or later; @sentry/google-cloud-serverless (npm): upgrade to 8.49.0 or later; @sentry/nestjs (npm): upgrade to 8.49.0 or later; @sentry/nextjs (npm): upgrade to 8.49.0 or later; @sentry/node (npm): upgrade to 8.49.0 or later; @sentry/nuxt (npm): upgrade to 8.49.0 or later; @sentry/remix (npm): upgrade to 8.49.0 or later; @sentry/solidstart (npm): upgrade to 8.49.0 or later; @sentry/sveltekit (npm): upgrade to 8.49.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run @sentry/astro (npm), @sentry/aws-serverless (npm), @sentry/bun (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sentry/astro (npm): upgrade to 8.49.0 or later
    npm install @sentry/astro@8.49.0
  • @sentry/aws-serverless (npm): upgrade to 8.49.0 or later
    npm install @sentry/aws-serverless@8.49.0
  • @sentry/bun (npm): upgrade to 8.49.0 or later
    npm install @sentry/bun@8.49.0
  • @sentry/google-cloud-serverless (npm): upgrade to 8.49.0 or later
    npm install @sentry/google-cloud-serverless@8.49.0
  • @sentry/nestjs (npm): upgrade to 8.49.0 or later
    npm install @sentry/nestjs@8.49.0
  • @sentry/nextjs (npm): upgrade to 8.49.0 or later
    npm install @sentry/nextjs@8.49.0
  • @sentry/node (npm): upgrade to 8.49.0 or later
    npm install @sentry/node@8.49.0
  • @sentry/nuxt (npm): upgrade to 8.49.0 or later
    npm install @sentry/nuxt@8.49.0
  • @sentry/remix (npm): upgrade to 8.49.0 or later
    npm install @sentry/remix@8.49.0
  • @sentry/solidstart (npm): upgrade to 8.49.0 or later
    npm install @sentry/solidstart@8.49.0
  • @sentry/sveltekit (npm): upgrade to 8.49.0 or later
    npm install @sentry/sveltekit@8.49.0

Technical details

The vulnerability is a resource leak (CWE-774) in the ContextLines integration that uses Node.js readable streams via createReadStream to efficiently read source files for attaching context to outgoing Sentry events. The streams are not explicitly closed after use, causing file handles to accumulate over time. An attacker with the ability to trigger errors in the application (or any legitimate error occurring frequently) can exhaust file descriptors, leading to denial of service. The vulnerability affects @sentry/node and all Node.js-based SDKs (@sentry/astro, @sentry/aws-serverless, @sentry/bun, @sentry/google-cloud-serverless, @sentry/nestjs, @sentry/nextjs, @sentry/nuxt, @sentry/remix, @sentry/solidstart, @sentry/sveltekit) with the ContextLines integration enabled by default in versions 8.10.0 through 8.48.x. The fix was released in version 8.49.0.

Affected products

  • Sentry @sentry/node 8.10.0 to 8.48.x
  • Sentry @sentry/astro 8.10.0 to 8.48.x
  • Sentry @sentry/aws-serverless 8.10.0 to 8.48.x
  • Sentry @sentry/bun 8.10.0 to 8.48.x
  • Sentry @sentry/google-cloud-serverless 8.10.0 to 8.48.x
  • Sentry @sentry/nestjs 8.10.0 to 8.48.x
  • Sentry @sentry/nextjs 8.10.0 to 8.48.x
  • Sentry @sentry/nuxt 8.10.0 to 8.48.x
  • Sentry @sentry/remix 8.10.0 to 8.48.x
  • Sentry @sentry/solidstart 8.10.0 to 8.48.x
  • Sentry @sentry/sveltekit 8.10.0 to 8.48.x

Timeline

  • 2025-01-28: disclosed: Advisory published
  • 2025-01-28: patched: Version 8.49.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.