CVE-2025-65944 Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`
Developers using Sentry-JavaScript with PII enabled may leak sensitive headers, allowing attackers to impersonate users or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65944?
CVE-2025-65944 is a medium-severity vulnerability in getsentry sentry-javascript, published on 25 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.
Weakness: CWE-201
Which versions are affected by CVE-2025-65944?
24 open source packages ship an affected version, including @sentry/astro, @sentry/aws-serverless and @sentry/bun.
| Package | Affected | Fixed in |
|---|---|---|
@sentry/astro npm | From 10.11.0 | 10.27.0 |
@sentry/astro npm | From 10.11.0 | 10.27.0 |
@sentry/aws-serverless npm | From 10.11.0 | 10.27.0 |
@sentry/aws-serverless npm | From 10.11.0 | 10.27.0 |
@sentry/bun npm | From 10.11.0 | 10.27.0 |
@sentry/bun npm | From 10.11.0 | 10.27.0 |
18 more packages
@sentry/google-cloud-serverless npm | From 10.11.0 | 10.27.0 |
@sentry/google-cloud-serverless npm | From 10.11.0 | 10.27.0 |
@sentry/nestjs npm | From 10.11.0 | 10.27.0 |
@sentry/nestjs npm | From 10.11.0 | 10.27.0 |
@sentry/nextjs npm | From 10.11.0 | 10.27.0 |
@sentry/nextjs npm | From 10.11.0 | 10.27.0 |
@sentry/node npm | From 10.11.0 | 10.27.0 |
@sentry/node npm | From 10.11.0 | 10.27.0 |
@sentry/node-core npm | From 10.11.0 | 10.27.0 |
@sentry/node-core npm | From 10.11.0 | 10.27.0 |
@sentry/nuxt npm | From 10.11.0 | 10.27.0 |
@sentry/nuxt npm | From 10.11.0 | 10.27.0 |
@sentry/remix npm | From 10.11.0 | 10.27.0 |
@sentry/remix npm | From 10.11.0 | 10.27.0 |
@sentry/solidstart npm | From 10.11.0 | 10.27.0 |
@sentry/solidstart npm | From 10.11.0 | 10.27.0 |
@sentry/sveltekit npm | From 10.11.0 | 10.27.0 |
@sentry/sveltekit npm | From 10.11.0 | 10.27.0 |
How do I fix CVE-2025-65944?
Upgrade @sentry/astro to 10.27.0 or later.
Is CVE-2025-65944 being exploited?
There is no known exploitation of CVE-2025-65944 in the wild and no public exploit code.
Sources
Also known as GHSA-6465-jgvq-jhgp.