CVE-2025-65944

Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

Published: Nov 25, 2025Updated: Nov 25, 2025 Sources: CVE List NVD GHSACWE-201

N/ACVSS

NVD MITRE

Description

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0.

No summary for this CVE yet.

Weaknesses

CWE-201

Affected Products

package-ecosystem

@sentry/aws-serverless

OSS Libraries

@sentry/bun

OSS Libraries

@sentry/google-cloud-serverless

commercialaka sentry-javascript, sentry, sentry-python

sentry-javascriptSaaS

Enterprise Software / itsm-monitoring

and 4 more affected products View all →

Exploitability

Official Patch Available

References

https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp

github.com

https://github.com/getsentry/sentry-javascript/pull/17475

github.com

https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539

github.com

and 6 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-65944 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows