opennextjs vulnerabilities

Products

• @opennextjs/cloudflare 3
• opennext for cloudflare 2
• opennextjs-cloudflare 1

Latest opennextjs CVEs

Newest publication first

1. CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

   Published 2026-10-15

   High·CVSS 7.5

   OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware...

2. CVE-2026-3125 SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass

   Published 2026-03-04

   High·CVSS 7.7

   A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for developmen...

3. CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

   Published 2025-06-16

   High·CVSS 7.8

   A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.