Skip to content
OpenAdvisories

Package · npm

@opennextjs/cloudflare

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-100409

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistentl…

    opennextjs @opennextjs/cloudflare @opennextjs/cloudflare npm
  • High 7.8
    CVE-2025-6087

    SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remo…

    @opennextjs/cloudflare npm