CVE-2023-46729
CVE-2023-46729 · Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
CVSS 9.3 · Critical · EPSS 0.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sentry-javascript
- Versions
- >= 7.26.0, < 7.77.0: Affected
No fix published
@sentry/nextjs npm
- Affected ranges
- SEMVER: ≥ 7.26.0, < 7.77.0
Update to 7.77.0