ZeroDay Findings
Sign inSign up

Findings

CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare.

Published Oct 15, 2026 · updated Oct 15, 2026

## Summary When cache interception is enabled, can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. is disabled by default. ## Impact A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware. An application is affected when it: - explicitly enables ; - relies on middleware for access control; and - has a matching cached route. ## Details Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry. For example, consider an application with: - middleware matcher ; - middleware returning for ; - a statically generated, cached route; and - cache interception enabled: An attacker can request: The encoded pathname does not match , so the authorization middleware is not invoked. Cache interception then decodes to and may return the cached response: Malformed paths exposed an additional inconsistency. For example: The previous implementation decoded each segment independently. It decoded to but retained the malformed segment, allowing cache lookup to continue using a partially decoded pathname. ## Patches The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200). Users should upgrade to or later. ## Workarounds If upgrading is not immediately possible for an application: 1. Disable cache interception by removing . 2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware. 3. Reject encod

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorizat

  2. Oct 15, 2026 · NIST NVD

    Updated

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorizat

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @opennextjs/cloudflare fixed in 1.20.2

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @opennextjs/cloudflare fixed in 1.20.2

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary When cache interception is enabled, can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. is disabled by default. ## Impact A remote unauthenticated

Affected

  • npm @opennextjsversion unspecified
  • npm @opennextjs/cloudflare0.3.0 → 1.20.2

Sources

  • CVE.orgVulnerability recordCVE-2026-100409

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-2vc4-c4r6-p6v6

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-100409

    When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. enableCacheInterception is disabled by default

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-100409

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware

    nvd.nist.gov
  • OSV.devPackage advisoryGHSA-2vc4-c4r6-p6v6

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    osv.dev

References