# GHSA-r5w7-f542-q2j4: Potential DoS when using ContextLines integration > An attacker can cause a Denial of Service by exhausting file handles via the ContextLines integration in the Sentry Node SDK. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 28 Jan 2025 ## What is GHSA-r5w7-f542-q2j4? GHSA-r5w7-f542-q2j4 is a denial of service vulnerability in @sentry/astro, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description ### Impact The [ContextLines integration](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/contextlines/) uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing events. The stream was not explicitly closed after use. This could lead to excessive amounts of file handles open on the system and potentially lead to a Denial of Service (DoS). The ContextLines integration is enabled by default in the Node SDK (`@sentry/node`) and SDKs that run in Node.js environments (`@sentry/astro`, `@sentry/aws-serverless`, `@sentry/bun`, `@sentry/google-cloud-serverless`, `@sentry/nestjs`, `@sentry/nextjs`, `@sentry/nuxt`, `@sentry/remix`, `@sentry/solidstart`, `@sentry/sveltekit`). ### Patches Users should upgrade to version `8.49.0` or higher. ### Workarounds To remediate this issue in affected versions without upgrading to version `8.49.0` and above you can disable the ContextLines integration. See the [docs](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/#removing-a-default-integration) for more details. ```js Sentry.init({ // ... integrations: function (integrations) { // integrations will be all default integrations return integrations.filter(function (integration) { return integration.name !== "ContextLines"; }); }, }); ``` If you disable the ContextLines integration, you will lose source context on your error events. ### References - Reported issue: https://github.com/getsentry/sentry-javascript/issues/14892 - PR Fix: https://github.com/getsentry/sentry-javascript/pull/14997 ## Which versions are affected by GHSA-r5w7-f542-q2j4? 22 open source packages ship an affected version, including @sentry/astro, @sentry/aws-serverless and @sentry/bun. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `@sentry/astro` | npm | From 8.10.0 | 8.49.0 | | `@sentry/astro` | npm | From 8.10.0 | 8.49.0 | | `@sentry/aws-serverless` | npm | From 8.10.0 | 8.49.0 | | `@sentry/aws-serverless` | npm | From 8.10.0 | 8.49.0 | | `@sentry/bun` | npm | From 8.10.0 | 8.49.0 | | `@sentry/bun` | npm | From 8.10.0 | 8.49.0 | | `@sentry/google-cloud-serverless` | npm | From 8.10.0 | 8.49.0 | | `@sentry/google-cloud-serverless` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nestjs` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nestjs` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nextjs` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nextjs` | npm | From 8.10.0 | 8.49.0 | | `@sentry/node` | npm | From 8.10.0 | 8.49.0 | | `@sentry/node` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nuxt` | npm | From 8.10.0 | 8.49.0 | | `@sentry/nuxt` | npm | From 8.10.0 | 8.49.0 | | `@sentry/remix` | npm | From 8.10.0 | 8.49.0 | | `@sentry/remix` | npm | From 8.10.0 | 8.49.0 | | `@sentry/solidstart` | npm | From 8.10.0 | 8.49.0 | | `@sentry/solidstart` | npm | From 8.10.0 | 8.49.0 | | `@sentry/sveltekit` | npm | From 8.10.0 | 8.49.0 | | `@sentry/sveltekit` | npm | From 8.10.0 | 8.49.0 | ## How do I fix GHSA-r5w7-f542-q2j4? Upgrade @sentry/astro to 8.49.0 or later. ## Is GHSA-r5w7-f542-q2j4 being exploited? There is no known exploitation of GHSA-r5w7-f542-q2j4 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-r5w7-f542-q2j4 and fix it if it is affected. What it is: GHSA-r5w7-f542-q2j4 is a denial of service vulnerability in @sentry/astro, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-r5w7-f542-q2j4 in the wild and no public exploit code. Affected packages and fixed versions: - @sentry/astro (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/astro (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/aws-serverless (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/aws-serverless (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/bun (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/bun (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/google-cloud-serverless (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/google-cloud-serverless (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/nestjs (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/nestjs (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/nextjs (npm): affected from 8.10.0; fixed in 8.49.0 - @sentry/nextjs (npm): affected from 8.10.0; fixed in 8.49.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/ (Markdown: https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-r5w7-f542-q2j4 --- From sbomify Insights: https://insights.sbomify.com/GHSA-r5w7-f542-q2j4/ Summaries are generated and may contain mistakes; the official description above is the record.