-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sentry/node | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/astro | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/aws-serverless | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/bun | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/google-cloud-serverless | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/nestjs | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/nextjs | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/nuxt | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/remix | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/solidstart | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
| @sentry/sveltekit | npm | >= 8.10.0, < 8.49.0 | 8.49.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the ContextLines integration did not explicitly close a readable stream, leading to potential DoS. The provided pull request and its commits show changes in packages/node/src/integrations/contextlines.ts. Specifically, the commit dc7422b12ff53b1fabb8c71f6a60a71473f7b516 modifies the getContextLinesFromFile function.
Before the patch, this function created a ReadableStream (fs.createReadStream) but did not have explicit stream.destroy() calls in all termination paths of the stream's lifecycle (e.g., when the readline.Interface emitted a 'close' event or when errors occurred). The patch introduces a helper function destroyStreamAndResolve which explicitly calls stream.destroy(). This new helper is then used in the onStreamError handler and as the callback for the lineReaded.on('close', ...) event, ensuring the stream is destroyed and file handles are released.
Therefore, getContextLinesFromFile is the function that directly handles the vulnerable resource (the file stream) and where the fix was applied, making it the vulnerable function.
JavaScriptJavaScriptKEV Misses 88% of Exploited CVEs- Get the report