{"id":"CVE-2025-65944","aliases":["GHSA-6465-jgvq-jhgp"],"url":"https://o3.security/vulnerability/CVE-2025-65944","summary":"Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`","details":"### Impact\nIn version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When `sendDefaultPii: true` was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.\n\nSentry’s server-side scrubbing (handled by Sentry's Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.\n\nUsers may be impacted if:\n\n1. Their Sentry SDK configuration has `sendDefaultPii` set to `true`\n2. Their application uses one of the Node.js Sentry SDKs with version from `10.11.0` to `10.26.0` inclusively:\n- @sentry/astro\n- @sentry/aws-serverless\n- @sentry/bun\n- @sentry/google-cloud-serverless\n- @sentry/nestjs\n- @sentry/nextjs\n- @sentry/node\n- @sentry/node-core\n- @sentry/nuxt\n- @sentry/remix\n- @sentry/solidstart\n- @sentry/sveltekit\n\nUsers can check if their project was affected, by visiting Explore → Traces and searching for “http.request.header.authorization”, “http.request.header.cookie” or similar. Any potentially sensitive values will be specific to users' applications and configurations.\n\n### Patches\nThe issue has been patched in all Sentry JavaScript SDKs starting from the [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) version.\n\n### Workarounds\nSentry strongly encourage customers to upgrade the SDK to the latest available version, [10.27.0](https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0) or later.\nIf it is not possible, consider setting `sendDefaultPii: false` to avoid unintentionally sending sensitive headers. See [here](https://docs.sentry.io/platforms/javascript/guides/node/#step-2-configure) for documentation.\n\n### Resources\n* https://develop.sentry.dev/sdk/expected-features/data-handling/#sensitive-data\n* https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0\n* https://github.com/getsentry/sentry-javascript/pull/17475\n* https://docs.sentry.io/platforms/javascript/guides/node/data-management/data-collected/#cookies","published":"2025-11-25T00:23:53.215Z","modified":"2026-08-12T03:51:43.917796543Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@sentry/node","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/astro","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/aws-serverless","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/bun","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/google-cloud-serverless","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/nestjs","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/nextjs","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/node-core","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/nuxt","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/remix","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/solidstart","fixedVersion":"10.27.0"},{"ecosystem":"npm","name":"@sentry/sveltekit","fixedVersion":"10.27.0"}],"fix":{"url":"https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539","label":"getsentry/sentry-javascript@a820fa2"},"references":[{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65944.json"},{"type":"ADVISORY","url":"https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65944"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539"},{"type":"FIX","url":"https://github.com/getsentry/sentry-javascript/pull/17475"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/pull/18311"},{"type":"PACKAGE","url":"https://github.com/getsentry/sentry-javascript"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases"},{"type":"WEB","url":"https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:43.917796543Z"}}