Executive brief
Sentry's JavaScript SDKs include a ContextLines integration that adds source code context to error reports for better debugging. The integration opens file streams to read source files but fails to close them after use, potentially exhausting system file handle limits and causing the application to become unresponsive. This affects all Node.js-based SDKs and is enabled by default.
Technical details
The vulnerability is a resource leak (CWE-774) in the ContextLines integration that uses Node.js readable streams via createReadStream to efficiently read source files for attaching context to outgoing Sentry events. The streams are not explicitly closed after use, causing file handles to accumulate over time. An attacker with the ability to trigger errors in the application (or any legitimate error occurring frequently) can exhaust file descriptors, leading to denial of service. The vulnerability affects @sentry/node and all Node.js-based SDKs (@sentry/astro, @sentry/aws-serverless, @sentry/bun, @sentry/google-cloud-serverless, @sentry/nestjs, @sentry/nextjs, @sentry/nuxt, @sentry/remix, @sentry/solidstart, @sentry/sveltekit) with the ContextLines integration enabled by default in versions 8.10.0 through 8.48.x. The fix was released in version 8.49.0.
Affected products
- Sentry @sentry/node 8.10.0 to 8.48.x
- Sentry @sentry/astro 8.10.0 to 8.48.x
- Sentry @sentry/aws-serverless 8.10.0 to 8.48.x
- Sentry @sentry/bun 8.10.0 to 8.48.x
- Sentry @sentry/google-cloud-serverless 8.10.0 to 8.48.x
- Sentry @sentry/nestjs 8.10.0 to 8.48.x
- Sentry @sentry/nextjs 8.10.0 to 8.48.x
- Sentry @sentry/nuxt 8.10.0 to 8.48.x
- Sentry @sentry/remix 8.10.0 to 8.48.x
- Sentry @sentry/solidstart 8.10.0 to 8.48.x
- Sentry @sentry/sveltekit 8.10.0 to 8.48.x
Timeline
- 2025-01-28: disclosed: Advisory published
- 2025-01-28: patched: Version 8.49.0 released with fix