CVE-2025-65944: Sentry-Javascript Cookie Header Disclosure

CVE-2025-65944 Overview

CVE-2025-65944 affects the official Sentry SDK for JavaScript when used in Node.js applications. Versions from 10.11.0 to before 10.27.0 inadvertently transmit sensitive HTTP headers, including the Cookie header, to Sentry when sendDefaultPii: true is configured. These headers are persisted within the Sentry organization as part of the associated trace data.

Any user with access to the Sentry organization can view these values. An attacker with such access could reuse captured session cookies or authentication headers to impersonate users or escalate privileges inside the affected application. The maintainers patched the issue in version 10.27.0.

Critical Impact
Sensitive HTTP headers including session cookies are exposed to anyone with Sentry organization access, enabling account impersonation and privilege escalation.

Affected Products

@sentry/node and related Sentry JavaScript SDK packages, versions 10.11.0 through 10.26.x
Node.js applications configured with sendDefaultPii: true
Downstream Sentry SDK integrations such as @sentry/astro that reuse Node request header capture

Discovery Timeline

2025-11-25 - CVE-2025-65944 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-65944

Vulnerability Analysis

The Sentry JavaScript SDK captures telemetry for Node.js HTTP servers using OpenTelemetry (OTel) instrumentation. Starting in version 10.11.0, a new feature attached incoming request headers as OTel span attributes to improve trace context.

When developers set sendDefaultPii: true, the SDK forwards request metadata to Sentry under the assumption that it contains personally identifiable information rather than secrets. The header-capture logic did not filter sensitive headers such as Cookie, Authorization, or Set-Cookie before attaching them to spans. As a result, authentication material was serialized into the trace payload sent to Sentry's ingestion endpoints.

This is an information exposure flaw tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data]. The data is not exposed to the public Internet, but it is exposed to every user within the Sentry organization that owns the project.

Root Cause

The root cause is a missing deny-list in the incoming-request header capture path introduced through pull request #17475. The SDK transformed winterCG-style request headers to a dictionary and attached them as span attributes without redacting known credential-bearing headers.

Attack Vector

Exploitation requires access to the Sentry organization that stores the traces. A malicious insider, a compromised Sentry account, or a third-party contractor with trace-read permissions can open any captured HTTP span and read the raw Cookie or Authorization header. The attacker then replays the credential against the upstream application to hijack the session or escalate privileges.

javascript

// Patch excerpt - security fix in packages/astro/src/index.server.ts
// feat(node): Add incoming request headers as OTel span attributes (#17475)
   getSpanStatusFromHttpCode,
   getTraceData,
   getTraceMetaTags,
+  httpHeadersToSpanAttributes,
+  winterCGHeadersToDict,
   graphqlIntegration,
   hapiIntegration,
   httpIntegration,

Source: GitHub Commit a820fa2

Detection Methods for CVE-2025-65944

Indicators of Compromise

Sentry spans or traces that contain http.request.header.cookie, http.request.header.authorization, or similar attribute keys populated with raw values
Deployed @sentry/node versions between 10.11.0 and 10.26.x combined with sendDefaultPii: true in SDK initialization
Access logs from the Sentry organization showing trace views by accounts that do not require production session data

Detection Strategies

Audit application source and configuration for Sentry.init({ ... sendDefaultPii: true }) and cross-reference with the installed SDK version in package-lock.json or yarn.lock
Query stored Sentry events through the Sentry API for span attributes matching header names such as cookie, authorization, x-api-key, or set-cookie
Review Sentry organization audit logs for unusual trace or event viewing patterns following the vulnerable release window

Monitoring Recommendations

Enforce least-privilege roles within Sentry so that only required engineers can read raw event payloads
Alert on new users, API tokens, or integrations added to Sentry organizations that store production traces
Monitor application authentication logs for session reuse from unexpected IP addresses after any suspected Sentry exposure

How to Mitigate CVE-2025-65944

Immediate Actions Required

Upgrade all Sentry JavaScript SDK packages to version 10.27.0 or later across every Node.js service
Rotate any session secrets, cookies, API keys, and bearer tokens that may have been captured in Sentry traces during the vulnerable window
Purge impacted events and traces from Sentry using the project data-scrubbing or event-deletion tooling

Patch Information

The fix shipped in Sentry JavaScript SDK version 10.27.0. See the GitHub Security Advisory GHSA-6465-jgvq-jhgp, Pull Request #17475, and the upstream commit a820fa2 for details. The patch redacts sensitive header names before they are attached as OTel span attributes.

Workarounds

Set sendDefaultPii: false in Sentry.init until the SDK can be upgraded
Configure a beforeSend or beforeSendTransaction hook that strips request.headers.cookie, authorization, and other credential-bearing headers
Enable Sentry's server-side data scrubbing rules for header fields to prevent sensitive values from being stored even if the SDK transmits them

bash

# Upgrade the SDK and verify installed version
npm install @sentry/node@^10.27.0
npm ls @sentry/node

# Temporary mitigation in Sentry.init if upgrade is delayed
# Sentry.init({
#   dsn: process.env.SENTRY_DSN,
#   sendDefaultPii: false,
#   beforeSend(event) {
#     if (event.request && event.request.headers) {
#       delete event.request.headers.cookie;
#       delete event.request.headers.authorization;
#     }
#     return event;
#   },
# });