CVE-2025-65944 | Vulnetix

CVE-2025-65944 PUBLISHED CVSS 5.099999904632568 MEDIUM

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.

EPSS 0.34% · 28.0th percentile

Risk Scores

CVSS 4.0

5.099999904632568

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

EPSS Score

0.34%

28.0th percentile

Affected Products

Vendor	Product	Versions
sentry	bun	10.11.0
sentry	nestjs	10.11.0
sentry	remix	10.11.0
sentry	node	10.11.0
sentry	solidstart	10.11.0
sentry	nextjs	10.11.0
sentry	sveltekit	10.11.0
sentry	google-cloud-serverless	10.11.0
sentry	astro	10.11.0
sentry	nuxt	10.11.0
getsentry	sentry-javascript	>= 10.11.0, < 10.27.0
sentry	aws-serverless	10.11.0
sentry	node-core	10.11.0

Timeline

Nov 24, 2025 CVE Published
Nov 25, 2025 EPSS Score
Nov 25, 2025 PoC Published
Nov 27, 2025 CVE Updated
Nov 30, 2025 EPSS Score
Dec 5, 2025 EPSS Score
Dec 10, 2025 EPSS Score
Dec 15, 2025 EPSS Score
Dec 20, 2025 EPSS Score
Dec 25, 2025 EPSS Score
Dec 30, 2025 EPSS Score
Jan 4, 2026 EPSS Score

References

Open in Interactive Console →