CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Reported by github_m · Published November 25, 2025
@sentry/nestjs is fixed in 10.27.0 (npm)
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| @sentry/nestjs | npm | 10.27.0 |
| @sentry/solidstart | npm | 10.27.0 |
| @sentry/nuxt | npm | 10.27.0 |
| @sentry/astro | npm | 10.27.0 |
| @sentry/bun | npm | 10.27.0 |
| @sentry/node | npm | 10.27.0 |
| @sentry/nextjs | npm | 10.27.0 |
| @sentry/node-core | npm | 10.27.0 |
| @sentry/remix | npm | 10.27.0 |
| @sentry/aws-serverless | npm | 10.27.0 |
| @sentry/sveltekit | npm | 10.27.0 |
| @sentry/google-cloud-serverless | npm | 10.27.0 |
1 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| getsentry | sentry-javascript | >= 10.11.0, < 10.27.0 |
| wolfi | langfuse | 0 |
| sentry | node-core | 10.11.0 |
| sentry | bun | 10.11.0 |
| sentry | node | 10.11.0 |
| sentry | astro | 10.11.0 |
| sentry | nuxt | 10.11.0 |
| sentry | nestjs | 10.11.0 |
| sentry | nextjs | 10.11.0 |
| sentry | sveltekit | 10.11.0 |
| getsentry | sentry-javascript | 10.11.0 |
| sentry | solidstart | 10.11.0 |
| sentry | remix | 10.11.0 |
| sentry | aws-serverless | 10.11.0 |
| sentry | google-cloud-serverless | 10.11.0 |
| chainguard | langfuse | 0 |
Timeline
- Nov 24, 2025 CVE Published
- Nov 25, 2025 EPSS Score (30 in total, the first dated here)
- Nov 25, 2025 PoC Published
- Nov 25, 2025 CVE Updated
- Mar 10, 2026 Security Advisory
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-65944
vulnetix vdb fixes CVE-2025-65944Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-65944/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp x_refsource_CONFIRM
- https://github.com/getsentry/sentry-javascript/pull/17475 x_refsource_MISC
- https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539 x_refsource_MISC
- https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-65944 advisory
- https://github.com/advisories/GHSA-6465-jgvq-jhgp advisory
- https://github.com/getsentry/sentry-javascript/pull/18311 patch
- https://github.com/getsentry/sentry-javascript url
- https://github.com/getsentry/sentry-javascript/releases url
- https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0 url