@sentry/nextjs tunnelRoute skipped Next.js middleware for more paths than it forwards to Sentry

CVE-2026-114139 was published October 21, 2026. The record, from GitHub, says that in @sentry/nextjs >=9.36.0 <9.47.2, >=10.0.0-alpha.0 <10.75.2, and >=11.0.0-alpha.0 <11.0.0-rc.1, the webpack integration skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite only serves the exact tunnel path with valid o and p query parameters. When an app route collides with the tunnel path, or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. The record names CWE-693 and scores it CVSS 4.0 9.1 Critical. NVD carries the same description.

Sentry's advisory, GHSA-mchm-gjx6-7h55, was published September 24, 2026 and rates it Medium. It says you are affected only if all four are true: tunnelRoute is set (a path or true), the app is built with webpack (Turbopack builds are not affected), some route resolves under the tunnel path, such as /monitoring/foo with tunnelRoute: '/monitoring' or a root dynamic segment like app/[locale]/, and middleware is the only place that enforces authorization for those routes. It says skipping middleware grants no privileges on its own, so routes that check the session server-side stay protected, and that Sentry's own services and the data in your Sentry organization are not affected.

The fix is in 9.47.2, 10.75.2, and 11.0.0-rc.1, with no configuration change needed. The advisory's workarounds are to set tunnelRoute to a path no route can resolve under or remove it, to build with Turbopack (the default for next build from Next.js 16), and to enforce authorization in the route, layout, or data-access path as well as in middleware.