-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability lies in the httpHeadersToSpanAttributes function within the @sentry/core package. This function was introduced to convert HTTP request headers to OpenTelemetry span attributes. The initial implementation of this function did not respect the sendDefaultPii configuration option, leading to the unconditional logging of all HTTP headers, including sensitive ones like Cookie and Authorization. The fix, introduced in commit 88c1db5ec04110a4f724f631940eabf661537513, added a check for the sendDefaultPii flag and a list of sensitive header snippets to filter out when sendDefaultPii is false. This prevents the leakage of sensitive information. The vulnerability affects multiple Sentry SDK packages for Node.js frameworks because they all use this core function to process request headers.
httpHeadersToSpanAttributespackages/core/src/utils/request.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sentry/node | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/astro | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/aws-serverless | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/bun | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/google-cloud-serverless | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/nestjs | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/nextjs | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/node-core | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/nuxt | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/remix | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/solidstart | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
| @sentry/sveltekit | npm | >= 10.11.0, < 10.27.0 | 10.27.0 |
Ongoing coverage of React2Shell