GHSA-6465-jgvq-jhgp
NoneCVSS
—
EPSS
—
Published
Nov 24, 2025
CISA due date
—
The record
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sentry/astro | 10.11.0 | 10.27.0 |
| npm | @sentry/aws-serverless | 10.11.0 | 10.27.0 |
| npm | @sentry/bun | 10.11.0 | 10.27.0 |
| npm | @sentry/google-cloud-serverless | 10.11.0 | 10.27.0 |
| npm | @sentry/nestjs | 10.11.0 | 10.27.0 |
| npm | @sentry/nextjs | 10.11.0 | 10.27.0 |
| npm | @sentry/node | 10.11.0 | 10.27.0 |
| npm | @sentry/node-core | 10.11.0 | 10.27.0 |
| npm | @sentry/nuxt | 10.11.0 | 10.27.0 |
| npm | @sentry/remix | 10.11.0 | 10.27.0 |
| npm | @sentry/solidstart | 10.11.0 | 10.27.0 |
| npm | @sentry/sveltekit | 10.11.0 | 10.27.0 |
| Chainguard | langfuse | 0 | 3.134.0-r1 |
| Chainguard | langfuse-compat | 0 | 3.134.0-r1 |
| Chainguard | langfuse-worker | 0 | 3.134.0-r1 |
| Wolfi | langfuse | 0 | 3.134.0-r1 |
| Wolfi | langfuse-compat | 0 | 3.134.0-r1 |
| Wolfi | langfuse-worker | 0 | 3.134.0-r1 |
Related vulnerabilities
- CVE-2025-65944 Sentry-Javascript is an official Sentry SDKs for JavaScript. Same vulnerability
- GHSA-wqch-xfxh-vrr4 body-parser is vulnerable to denial of service when url encoding is used Also affects langfuse
- CVE-2025-13466 body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of… Also affects langfuse
- GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true Also affects langfuse
- CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true Also affects langfuse
- CVE-2025-13033 A vulnerability was identified in the email parsing library due to improper handling of… Also affects langfuse
- GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) Also affects langfuse
- CVE-2025-64718 js-yaml is a JavaScript YAML parser and dumper. Also affects langfuse