ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare.

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · OpenNext Cloudflare is an

Check if you run it

No confirmed exploitation is on record for CVE-2026-100409. EPSS is 0.30%. Act only if a listed version of OpenNext Cloudflare is an is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (OpenNext Cloudflare is an).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.30%
Remediation
Version ranges on file
Affected products
npm @opennextjs · npm @opennextjs/cloudflare

## Summary When cache interception is enabled, can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. is disabled by default. ## Impact A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware. An application is affected when it: - explicitly enables ; - relies on middleware for access control; and - has a matching cached route. ## Details Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry. For example, consider an application with: - middleware matcher ; - middleware returning for ; - a statically generated, cached route; and - cache interception enabled: An attacker can request: The encoded pathname does not match , so the authorization middleware is not invoked. Cache interception then decodes to and may return the cached response: Malformed paths exposed an additional inconsistency. For example: The previous implementation decoded each segment independently. It decoded to but retained the malformed segment, allowing cache lookup to continue using a partially decoded pathname. ## Patches The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200). Users should upgrade to or later. ## Workarounds If upgrading is not immediately possible for an application: 1. Disable cache interception by removing . 2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware. 3. Reject encod

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @opennextjsversion unspecified
  • npm @opennextjs/cloudflare0.3.0 → 1.20.2
  • npm @opennextjs/cloudflare>= 0.3.0, < 1.20.2

How to fix CVE-2026-100409

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-100409. EPSS is 0.30%. Act only if a listed version of OpenNext Cloudflare is an is installed.

Which versions are affected?

Compare what you have installed with 0.3.0 → 1.20.2, >= 0.3.0, < 1.20.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-177; CWE-180. EPSS 0.30%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorizat

  2. Oct 15, 2026 · NIST NVD

    Updated

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorizat

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @opennextjs/cloudflare fixed in 1.20.2

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @opennextjs/cloudflare fixed in 1.20.2

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary When cache interception is enabled, can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. is disabled by default. ## Impact A remote unauthenticated

Sources

  • CVE.orgVulnerability recordCVE-2026-100409

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-100409

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-2vc4-c4r6-p6v6

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-100409

    When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. enableCacheInterception is disabled by default

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-100409

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-2vc4-c4r6-p6v6

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.