{"answers":{"affected":"22 open source packages ship an affected version, including @sentry/astro, @sentry/aws-serverless and @sentry/bun.","exploited":"There is no known exploitation of GHSA-r5w7-f542-q2j4 in the wild and no public exploit code.","fix":"Upgrade @sentry/astro to 8.49.0 or later.","what":"GHSA-r5w7-f542-q2j4 is a denial of service vulnerability in @sentry/astro, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-r5w7-f542-q2j4 and fix it if it is affected.\n\nWhat it is: GHSA-r5w7-f542-q2j4 is a denial of service vulnerability in @sentry/astro, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-r5w7-f542-q2j4 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @sentry/astro (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/astro (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/aws-serverless (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/aws-serverless (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/bun (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/bun (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/google-cloud-serverless (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/google-cloud-serverless (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/nestjs (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/nestjs (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/nextjs (npm): affected from 8.10.0; fixed in 8.49.0\n- @sentry/nextjs (npm): affected from 8.10.0; fixed in 8.49.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/ (Markdown: https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/index.md)","id":"GHSA-r5w7-f542-q2j4","markdown":"https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/index.md","name":"GHSA-r5w7-f542-q2j4","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Sentry Node SDK","requires_auth":"none","summary":"An attacker can cause a Denial of Service by exhausting file handles via the ContextLines integration in the Sentry Node SDK.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nThe [ContextLines integration](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/contextlines/) uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing events.\n\nThe stream was not explicitly closed after use. This could lead to excessive amounts of file handles open on the system and potentially lead to a Denial of Service (DoS).\n\nThe ContextLines integration is enabled by default in the Node SDK (`@sentry/node`) and SDKs that run in Node.js environments (`@sentry/astro`, `@sentry/aws-serverless`, `@sentry/bun`, `@sentry/google-cloud-serverless`, `@sentry/nestjs`, `@sentry/nextjs`, `@sentry/nuxt`, `@sentry/remix`, `@sentry/solidstart`, `@sentry/sveltekit`).\n\n### Patches\n\nUsers should upgrade to version `8.49.0` or higher.\n\n### Workarounds\n\nTo remediate this issue in affected versions without upgrading to version `8.49.0` and above you can disable the ContextLines integration. See the [docs](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/#removing-a-default-integration) for more details.\n\n```js\nSentry.init({\n  // ...\n  integrations: function (integrations) {\n    // integrations will be all default integrations\n    return integrations.filter(function (integration) {\n      return integration.name !== \"ContextLines\";\n    });\n  },\n});\n```\n\nIf you disable the ContextLines integration, you will lose source context on your error events.\n\n### References\n- Reported issue: https://github.com/getsentry/sentry-javascript/issues/14892\n- PR Fix: https://github.com/getsentry/sentry-javascript/pull/14997","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Potential DoS when using ContextLines integration","id":"GHSA-r5w7-f542-q2j4","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":22,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/astro","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/astro","purl":"pkg:npm/%40sentry/astro","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/aws-serverless","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/aws-serverless","purl":"pkg:npm/%40sentry/aws-serverless","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/bun","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/bun","purl":"pkg:npm/%40sentry/bun","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/google-cloud-serverless","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/google-cloud-serverless","purl":"pkg:npm/%40sentry/google-cloud-serverless","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nestjs","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nestjs","purl":"pkg:npm/%40sentry/nestjs","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nextjs","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nextjs","purl":"pkg:npm/%40sentry/nextjs","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/node","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/node","purl":"pkg:npm/%40sentry/node","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nuxt","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/nuxt","purl":"pkg:npm/%40sentry/nuxt","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/remix","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/remix","purl":"pkg:npm/%40sentry/remix","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/solidstart","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/solidstart","purl":"pkg:npm/%40sentry/solidstart","source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/sveltekit","purl":null,"source":"GHSA-r5w7-f542-q2j4"},{"ecosystem":"npm","fixed":["8.49.0"],"introduced":["8.10.0"],"last_affected":[],"package":"@sentry/sveltekit","purl":"pkg:npm/%40sentry/sveltekit","source":"GHSA-r5w7-f542-q2j4"}],"products":null,"published":"2025-01-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can cause a Denial of Service by exhausting file handles via the ContextLines integration in the Sentry Node SDK.","url":"https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/"}