PT-2025-47977 · Sentry · Sentry-Javascript

Published 2025-11-24 · Updated 2025-11-25 · CVE-2025-65944

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Sentry-Javascript versions 10.11.0 through 10.26.9

Description Sentry-Javascript is an official Sentry SDK for JavaScript. When a Node.js application using the SDK has sendDefaultPii set to true, sensitive HTTP headers, including the Cookie header, can be inadvertently sent to Sentry. These headers are stored within a Sentry organization as part of the associated trace, potentially allowing individuals with access to the organization to view and use these sensitive values for impersonation or privilege escalation. The sendDefaultPii variable controls the sending of Personally Identifiable Information (PII).

Recommendations Update to version 10.27.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-65944

GHSA-6465-JGVQ-JHGP

Affected Products

Sentry-Javascript

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65944.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65944 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6465-jgvq-jhgp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65944 · Security Note
• https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539 · Note
• https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0 · Note
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp · Note
• https://github.com/getsentry/sentry-javascript/releases/tag/10.27.0 · Note
• https://github.com/getsentry/sentry-javascript/pull/18311 · Note
• https://github.com/getsentry/sentry-javascript · Note
• https://github.com/getsentry/sentry-javascript/releases · Note
• https://github.com/getsentry/sentry-javascript/pull/17475 · Note
• https://twitter.com/CVEnew/status/1993125714296815993 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993171476665544754 · Twitter Post
• https://t.me/cveNotify/143893 · Telegram Post