Back to Database
Status published
Critical
CVE-2023-46729
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
Vulnerability Description
sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46729
Credits & Attribution
No credits recorded in the NVD database.
References
More from getsentry
View All →CVE-2025-65944
Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`
Medium
5.1
CVE-2025-53099
Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation
Medium
5.5
CVE-2025-22146
Improper authentication on SAML SSO process allows user impersonation in sentry
Critical
9.1
CVE-2024-53253
Sentry's improper error handling leaks Application Integration Client Secret
Medium
5.3
CVE-2024-45606
Improper authorization on muting of alert rules in sentry
High
7.1
Affected Vendor
getsentry
View all reports →Affected Software
sentry-javascript
Vulnerable Versions:
>= 7.26.0, < 7.77.0
Timeline
Official Publish:
November 10th, 2023
Last Modified:
September 3rd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N