Next.js tunnel handler mode records the server IP instead of the client IP on sentry.io #26154

Package: @sentry/nextjs 11.10.0 (@sentry/core 11.10.0), Next.js 16.4.5, self-hosted Node behind Cloudflare and nginx, SaaS ingest on the de region

What happens

With tunnelRoute: "/monitoring" and src/app/sentry-tunnel/route.ts containing export { POST } from "@sentry/nextjs/tunnel" (handler mode), browser events arrive with the server's IP as user.ip_address, not the visitor's. Geo and "users impacted" for browser issues then reflect the server.

In rewrite mode, the same setup recorded the visitor's IP correctly.

Reproduction

1. Send an event with "user": {"ip_address": "{{auto}}"} through the tunnel route from a client.
2. The request reaches the app with CF-Connecting-IP and X-Forwarded-For set to the client IP.
3. The stored event has user.ip_address = the server's IP.

Likely cause

forwardHeaders in packages/core/src/utils/tunnelForward.ts sends the client IP only as X-Sentry-Forwarded-For. Relay's ForwardedFor extractor says "The Sentry SaaS infrastructure sets this header", so on sentry.io the value seems to be overwritten with the connecting IP, which is our server.

Rewrite mode works because the proxy passes all request headers through, including CF-Connecting-IP, which Relay ranks first.

Possible fix

Also forward the client IP in a header that Relay prefers and that SaaS doesn't overwrite. Or document that handler mode loses the client IP on SaaS.