@sentry/nextjs
Official Sentry SDK for Next.js
About
Official Sentry SDK for Next.js
What detecting @sentry/nextjs tells you about a site
Finding @sentry/nextjs is a two-for-one signal: the site is built on Next.js, and the team instrumented it for error and performance monitoring across both client and server. This package wires Sentry into the full Next.js surface area, capturing exceptions in server components, API routes, edge functions and the browser alike. Its presence tells you observability is set up end to end rather than only client-side, which points to a team that runs Next.js in production seriously. It also strongly implies build-time sourcemap upload to Sentry, since that is how the wrapper de-minifies the traces it captures.
Why the exact @sentry/nextjs version matters
This wrapper is tightly coupled to specific Next.js versions, so its major tracks the App Router and server-component eras; the version 8 line reworked configuration to lean on instrumentation hooks and changed how the build plugin injects itself. The exact version tells you which Next.js generation the site targets and how deeply the server side is instrumented.
@sentry/nextjs in a real-world stack
When you find @sentry/nextjs in a bundle, it rarely travels alone. Next.js itself, plus the underlying @sentry/react and @sentry/node SDKs it composes.
Quick facts
npm install @sentry/nextjsCommon pairings
Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.
What @sentry/nextjs pulls in
@sentry/nextjs declares 14 direct dependencies — each one also rides into any bundle that ships @sentry/nextjs, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .
How Sourcemap Explorer detects @sentry/nextjs
@sentry/nextjs ships as v10.69.0, published 2026-07-29 and carries 14 direct dependencies, 1 peer dependency (next), 513 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when @sentry/nextjs rides inside a deployed bundle — here is how the detection works.
We catch @sentry/nextjs from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/@sentry/nextjs/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `@sentry/nextjs` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/@sentry/nextjs/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/@sentry/nextjs/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/@sentry/nextjs/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Major releases of @sentry/nextjs
When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the @sentry/nextjs version a site actually ships against the ecosystem.
Recent security advisories for @sentry/nextjs
The 3 most recent advisories affecting some versions of @sentry/nextjs, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Potential DoS when using ContextLines integration
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
Recent versions
@sentry/nextjs README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
Bad software is everywhere, and we're tired of it. Sentry is on a mission to help developers write better software faster, so we can get back to enjoying technology. If you want to join us Check out our open positions
Official Sentry SDKs for JavaScript
This is the next line of Sentry JavaScript SDKs, comprised in the @sentry/ namespace. It will provide a more
convenient interface and improved consistency between various JavaScript environments.
Links
Contents
Supported Platforms
For each major JavaScript platform, there is a specific high-level SDK that provides all the tools you need in a single package. Please refer to the README and instructions of those SDKs for more detailed information:
@sentry/browser: SDK for Browsers@sentry/node: SDK for Node including integrations for Express@sentry/angular: Browser SDK for Angular@sentry/astro: SDK for Astro@sentry/ember: Browser SDK for Ember@sentry/react: Browser SDK for React@sentry/svelte: Browser SDK for Svelte@sentry/sveltekit: SDK for SvelteKit@sentry/vue: Browser SDK for Vue@sentry/solid: Browser SDK for Solid@sentry/gatsby: SDK for Gatsby@sentry/nestjs: SDK for NestJS@sentry/nextjs: SDK for Next.js@sentry/nitro: SDK for Nitro@sentry/remix: SDK for Remix@sentry/tanstackstart-react: SDK for TanStack Start React@sentry/aws-serverless: SDK for AWS Lambda Functions@sentry/google-cloud-serverless: SDK for Google Cloud Functions@sentry/electron: SDK for Electron with support for native crashes@sentry/react-native: SDK for React Native with support for native crashes@sentry/capacitor: SDK for Capacitor Apps and Ionic with support for native crashes@sentry/effect: SDK for Effect (Alpha)@sentry/bun: SDK for Bun@sentry/elysia: SDK for Elysia@sentry/deno: SDK for Deno@sentry/cloudflare: SDK for Cloudflare
Version Support Policy
We recognize the importance of continued support for our SDK across different versions. Our commitment is to provide bug fixes and feature updates for older versions based on community demand and usage.
Installation and Usage
To install a SDK, simply add the high-level package, for example:
npm install --save @sentry/browser
yarn add @sentry/browser
Setup and usage of these SDKs always follows the same principle.
import * as Sentry from '@sentry/browser';
Sentry.init({
dsn: '__DSN__',
// ...
});
Sentry.captureMessage('Hello, world!');
Other Packages
Besides the high-level SDKs, this repository contains shared packages, helpers and configuration used for SDK development. If you're thinking about contributing to or creating a JavaScript-based SDK, have a look at the resources below:
@sentry/replay: Provides the integration for Session Replay.@sentry/core: The base for all JavaScript SDKs with interfaces, type definitions and base classes.
Bug Bounty Program
Our bug bounty program aims to improve the security of our open source projects by encouraging the community to identify and report potential security vulnerabilities. Your reward will depend on the severity of the identified vulnerability.
Our program is currently running on an invitation basis. If you're interested in participating, please send us an email to security@sentry.io and tell us, that you are interested in auditing this repository.
For more details, please have a look at https://sentry.io/security/#vulnerability-disclosure.
Contributors
Thanks to everyone who contributed to the Sentry JavaScript SDK!
FAQ
What is @sentry/nextjs used for?
Official Sentry SDK for Next.js
How can I tell if a website is using @sentry/nextjs?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `@sentry/nextjs` from two complementary signals: `node_modules/@sentry/nextjs/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of @sentry/nextjs a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `@sentry/nextjs/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/@sentry/nextjs/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 10.69.0, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of @sentry/nextjs?
10.69.0, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is @sentry/nextjs actively maintained?
Very actively maintained — the last release shipped within the past three months. The last published release was 2026-07-29. Source code: https://github.com/getsentry/sentry-javascript.
Does @sentry/nextjs have known security vulnerabilities?
3 recent advisories affecting some versions of @sentry/nextjs are listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.
Where can I read more?
Project homepage: https://github.com/getsentry/sentry-javascript/tree/master/packages/nextjs. Source code: https://github.com/getsentry/sentry-javascript. Published on npm: https://www.npmjs.com/package/@sentry/nextjs. Licensed as MIT.
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for @sentry/nextjs and report the precise version (the registry's latest is v10.69.0, published 2026-07-29; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.