fix(nextjs): Make request data available to tracesSampler for edge middleware root spans

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);
 

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware-2/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'Jane Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/api/endpoint-behind-middleware/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export function GET() {
+ return NextResponse.json({ name: 'John Doe' });
+}

dev-packages/e2e-tests/test-applications/nextjs-15/middleware.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+ // Keep this invocation in-flight for a bit so a concurrent request to the other matched endpoint genuinely
+ // overlaps with it — the concurrency test in tests/middleware.test.ts relies on this overlap.
+ if (request.nextUrl.pathname === '/api/endpoint-behind-middleware-2') {
+ await new Promise(resolve => setTimeout(resolve, 300));
+ }
+
+ return NextResponse.next();
+}
+
+// See "Matching Paths" below to learn more
+export const config = {
+ matcher: ['/api/endpoint-behind-middleware', '/api/endpoint-behind-middleware-2'],
+};

dev-packages/e2e-tests/test-applications/nextjs-15/sentry.edge.config.ts

@@ -4,7 +4,21 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time and belongs to
+ // the request that is being sampled (guards against concurrent requests leaking into each other's sampling
+ // context). The middleware e2e tests time out and fail when the transaction is dropped here.
+ const { normalizedRequest } = samplingContext;
+ return Boolean(
+ normalizedRequest?.method &&
+ normalizedRequest?.url &&
+ normalizedRequest.url === samplingContext.attributes['http.target'],
+ );
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  transportOptions: {
  // We are doing a lot of events at once in this test

dev-packages/e2e-tests/test-applications/nextjs-15/tests/middleware.test.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { waitForTransaction } from '@sentry-internal/test-utils';
+
+// The `tracesSampler` in `sentry.edge.config.ts` only samples `Middleware.execute` spans when `normalizedRequest`
+// is available at sampling time, so this test times out if the request data does not reach the sampler.
+test('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ const response = await request.get('/api/endpoint-behind-middleware');
+ expect(await response.json()).toStrictEqual({ name: 'John Doe' });
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('vercel-edge');
+ expect(middlewareTransaction.contexts?.trace?.op).toBe('http.server.middleware');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
+// The `tracesSampler` additionally asserts that `normalizedRequest.url` matches the sampled span's own
+// `http.target`, so a request leaking into the sampling context of a concurrent one drops that transaction
+// and times this test out.
+test('does not leak normalizedRequest between concurrent middleware invocations', async ({ request }) => {
+ const firstTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware'
+ );
+ });
+
+ const secondTransactionPromise = waitForTransaction('nextjs-15', async transactionEvent => {
+ return (
+ transactionEvent?.transaction === 'middleware GET' &&
+ transactionEvent.contexts?.trace?.data?.['http.target'] === '/api/endpoint-behind-middleware-2'
+ );
+ });
+
+ await Promise.all([request.get('/api/endpoint-behind-middleware'), request.get('/api/endpoint-behind-middleware-2')]);
+
+ const [firstTransaction, secondTransaction] = await Promise.all([firstTransactionPromise, secondTransactionPromise]);
+
+ expect(firstTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(firstTransaction.request?.url).not.toContain('/api/endpoint-behind-middleware-2');
+ expect(secondTransaction.request?.url).toContain('/api/endpoint-behind-middleware-2');
+});

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/sentry.edge.config.ts

@@ -4,7 +4,16 @@ Sentry.init({
  environment: 'qa', // dynamic sampling bias to keep transactions
  dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
  tunnel: `http://localhost:3031/`, // proxy server
- tracesSampleRate: 1.0,
+ tracesSampler: samplingContext => {
+ if (samplingContext.attributes?.['next.span_type'] === 'Middleware.execute') {
+ // Only keep the middleware transaction when `normalizedRequest` was available at sampling time.
+ // Test times out and fails when transaction is dropped
+ const { normalizedRequest } = samplingContext;
+ return Boolean(normalizedRequest?.url && normalizedRequest?.method);
+ }
+
+ return 1.0;
+ },
  dataCollection: { userInfo: true },
  // debug: true,
 });

dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers/tests/middleware.test.ts

@@ -2,6 +2,21 @@ import { expect, test } from '@playwright/test';
 import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 import { isDevMode } from './isDevMode';
 
+// TODO: Skipped until the Cloudflare Workers edge middleware setup emits middleware transactions reliably.
+test.skip('tracesSampler receives normalizedRequest for edge middleware', async ({ request }) => {
+ const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {
+ return transactionEvent?.transaction === 'middleware GET';
+ });
+
+ await request.get('/api/endpoint-behind-middleware');
+
+ const middlewareTransaction = await middlewareTransactionPromise;
+
+ expect(middlewareTransaction.contexts?.runtime?.name).toBe('cloudflare');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+ expect(middlewareTransaction.request?.method).toBe('GET');
+});
+
 // TODO: Middleware tests need SDK adjustments for Cloudflare Workers edge runtime
 test.skip('Should create a transaction for middleware', async ({ request }) => {
  const middlewareTransactionPromise = waitForTransaction('nextjs-16-cf-workers', async transactionEvent => {

dev-packages/e2e-tests/test-applications/nextjs-16/tests/middleware.test.ts

@@ -21,6 +21,9 @@ test('Should create a transaction for middleware', async ({ request }) => {
  expect(middlewareTransaction.contexts?.runtime?.name).toBe('node');
  expect(middlewareTransaction.transaction_info?.source).toBe('route');
 
+ expect(middlewareTransaction.request?.method).toBe('GET');
+ expect(middlewareTransaction.request?.url).toContain('/api/endpoint-behind-middleware');
+
  // Assert that isolation scope works properly
  expect(middlewareTransaction.tags?.['my-isolated-tag']).toBe(true);
  expect(middlewareTransaction.tags?.['my-global-scope-isolated-tag']).not.toBeDefined();

packages/nextjs/src/common/utils/forkIsolationScopeForRootSpan.ts

@@ -0,0 +1,38 @@
+import { context } from '@opentelemetry/api';
+import type { Span, SpanAttributes } from '@sentry/core';
+import {
+ getCapturedScopesOnSpan,
+ getCurrentScope,
+ getIsolationScope,
+ getRootSpan,
+ setCapturedScopesOnSpan,
+} from '@sentry/core';
+import { getScopesFromContext } from '@sentry/opentelemetry';
+import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
+
+/**
+ * Forks the isolation scope for `BaseServer.handleRequest` / `Middleware.execute` root spans so that request-scoped
+ * data (e.g. `normalizedRequest`) stays isolated per request.
+ */
+export function maybeForkIsolationScopeForRootSpan(span: Span, spanAttributes: SpanAttributes | undefined): void {
+ const spanType = spanAttributes?.[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'BaseServer.handleRequest' && spanType !== 'Middleware.execute') {
+ return;
+ }
+
+ if (span !== getRootSpan(span)) {
+ return;
+ }
+
+ const scopes = getCapturedScopesOnSpan(span);
+
+ const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
+ const scope = scopes.scope || getCurrentScope();
+
+ const currentScopesPointer = getScopesFromContext(context.active());
+ if (currentScopesPointer) {
+ currentScopesPointer.isolationScope = isolationScope;
+ }
+
+ setCapturedScopesOnSpan(span, scope, isolationScope);
+}

packages/nextjs/src/common/utils/getNormalizedRequestFromAttributes.ts

@@ -0,0 +1,48 @@
+import {
+ HTTP_METHOD,
+ HTTP_REQUEST_METHOD,
+ HTTP_TARGET,
+ HTTP_URL,
+ URL_FULL,
+ URL_PATH,
+ URL_QUERY,
+} from '@sentry/conventions/attributes';
+import type { RequestEventData, SpanAttributes } from '@sentry/core';
+
+/**
+ * Builds a partial `normalizedRequest` from OTel HTTP span attributes.
+ * Only method, URL, and query string can be derived — headers are not available as span attributes.
+ */
+export function getNormalizedRequestFromAttributes(attributes: SpanAttributes): RequestEventData | undefined {
+ // eslint-disable-next-line typescript/no-deprecated
+ const method = attributes[HTTP_REQUEST_METHOD] || attributes[HTTP_METHOD];
+
+ // eslint-disable-next-line typescript/no-deprecated
+ const url = attributes[URL_FULL] || attributes[HTTP_URL] || attributes[URL_PATH] || attributes[HTTP_TARGET];
+
+ if (typeof method !== 'string' && typeof url !== 'string') {
+ return undefined;
+ }
+
+ const normalizedRequest: RequestEventData = {};
+
+ if (typeof method === 'string') {
+ normalizedRequest.method = method;
+ }
+
+ if (typeof url === 'string') {
+ normalizedRequest.url = url;
+
+ const queryFromAttribute = attributes[URL_QUERY];
+ if (typeof queryFromAttribute === 'string') {
+ normalizedRequest.query_string = queryFromAttribute;
+ } else {
+ const queryIndex = url.indexOf('?');
+ if (queryIndex !== -1) {
+ normalizedRequest.query_string = url.slice(queryIndex + 1);
+ }
+ }
+ }
+
+ return normalizedRequest;
+}

packages/nextjs/src/edge/index.ts

@@ -1,11 +1,8 @@
 // import/export got a false positive, and affects most of our index barrel files
 // can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
 /* eslint-disable import/export */
-import { context } from '@opentelemetry/api';
 import {
  applySdkMetadata,
- getCapturedScopesOnSpan,
- getCurrentScope,
  getGlobalScope,
  getIsolationScope,
  getRootSpan,
@@ -14,17 +11,17 @@ import {
  SEMANTIC_ATTRIBUTE_SENTRY_OP,
  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
- setCapturedScopesOnSpan,
  spanToJSON,
 } from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
 import { DEBUG_BUILD } from '../common/debug-build';
 import { ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../common/span-attributes-with-logic-attached';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
+import { getNormalizedRequestFromAttributes } from '../common/utils/getNormalizedRequestFromAttributes';
 import { isBuild } from '../common/utils/isBuild';
 import { flushSafelyWithTimeout, isCloudflareWaitUntilAvailable, waitUntil } from '../common/utils/responseEnd';
 import { setUrlProcessingMetadata } from '../common/utils/setUrlProcessingMetadata';
@@ -101,6 +98,26 @@ export function init(options: VercelEdgeOptions = {}): void {
 
  const client = vercelEdgeInit(opts);
 
+ // Next.js's OTel instrumentation samples root spans before the Sentry middleware wrapper can set
+ // `normalizedRequest` on the isolation scope. Seed it from span attributes so `tracesSampler` has access.
+ client?.on('beforeSampling', ({ spanAttributes }) => {
+ const spanType = spanAttributes[ATTR_NEXT_SPAN_TYPE];
+ if (spanType !== 'Middleware.execute' && spanType !== 'BaseServer.handleRequest') {
+ return;
+ }
+
+ // Clear the key before writing: `setSDKProcessingMetadata` merges into nested objects, so a partial request
+ // (or none at all) would otherwise keep stale fields (e.g. `query_string`) left on the (potentially shared)
+ // isolation scope by a previous request on a warm worker.
+ const isolationScope = getIsolationScope();
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest: undefined });
+
+ const normalizedRequest = getNormalizedRequestFromAttributes(spanAttributes);
+ if (normalizedRequest) {
+ isolationScope.setSDKProcessingMetadata({ normalizedRequest });
+ }
+ });
+
  client?.on('spanStart', span => {
  const spanAttributes = spanToJSON(span).data;
  const rootSpan = getRootSpan(span);
@@ -120,19 +137,7 @@ export function init(options: VercelEdgeOptions = {}): void {
  }
 
  // We want to fork the isolation scope for incoming requests
- if (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' && isRootSpan) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  if (isRootSpan) {
  // todo: check if we can set request headers for edge on sdkProcessingMetadata

packages/nextjs/src/server/handleOnSpanStart.ts

@@ -1,19 +1,10 @@
-import { context } from '@opentelemetry/api';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_ROUTE } from '@sentry/conventions/attributes';
 import type { Span } from '@sentry/core';
-import {
- getCapturedScopesOnSpan,
- getCurrentScope,
- getIsolationScope,
- getRootSpan,
- SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
- setCapturedScopesOnSpan,
- spanToJSON,
-} from '@sentry/core';
-import { getScopesFromContext } from '@sentry/opentelemetry';
+import { getIsolationScope, getRootSpan, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, spanToJSON } from '@sentry/core';
 import { ATTR_NEXT_ROUTE, ATTR_NEXT_SPAN_NAME, ATTR_NEXT_SPAN_TYPE } from '../common/nextSpanAttributes';
 import { addHeadersAsAttributes } from '../common/utils/addHeadersAsAttributes';
 import { dropMiddlewareTunnelRequests } from '../common/utils/dropMiddlewareTunnelRequests';
+import { maybeForkIsolationScopeForRootSpan } from '../common/utils/forkIsolationScopeForRootSpan';
 import { maybeEnhanceServerComponentSpanName } from '../common/utils/tracingUtils';
 import { maybeStartCronCheckIn } from './vercelCronsMonitoring';
 import { maybeEnrichQueueConsumerSpan, maybeEnrichQueueProducerSpan } from './vercelQueuesMonitoring';
@@ -84,25 +75,7 @@ export function handleOnSpanStart(span: Span): void {
  addHeadersAsAttributes(headers, rootSpan);
  }
 
- // We want to fork the isolation scope for incoming requests. Root `Middleware.execute` spans need the same
- // treatment since Next.js 16.3.0-canary.79
- if (
- (spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'BaseServer.handleRequest' ||
- spanAttributes?.[ATTR_NEXT_SPAN_TYPE] === 'Middleware.execute') &&
- isRootSpan
- ) {
- const scopes = getCapturedScopesOnSpan(span);
-
- const isolationScope = (scopes.isolationScope || getIsolationScope()).clone();
- const scope = scopes.scope || getCurrentScope();
-
- const currentScopesPointer = getScopesFromContext(context.active());
- if (currentScopesPointer) {
- currentScopesPointer.isolationScope = isolationScope;
- }
-
- setCapturedScopesOnSpan(span, scope, isolationScope);
- }
+ maybeForkIsolationScopeForRootSpan(span, spanAttributes);
 
  maybeEnhanceServerComponentSpanName(span, spanAttributes, rootSpanAttributes);