Go to packages list

opennextjs-cloudflare

Ecosystem: npm

Downloads: 7.51 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 3 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High3 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting opennextjs-cloudflare, based on data from OSV.

Vulnerabilities affecting opennextjs-cloudflare
IDSeveritySummaryAffected versionsPublishedSource
GHSA-2vc4-c4r6-p6v6HighOpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths## Summary When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. `enableCacheInterception` is disabled by default. ## Impact A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware. An application is affected when it: - explicitly ena
  • >= 0.3.0, < 1.20.2
GitHub (opens in a new tab)
GHSA-c7mq-gh6q-6q7cHighopennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypassA Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript
  • < 1.17.1
GitHub (opens in a new tab)
GHSA-rvpw-p7vw-wj3mHighOpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpointA Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the `/_next/image` endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: `https://victim-site.com/_next/image?url=https://attacker.com`. In this example, attacker-controlled conten
  • < 1.3.0
GitHub (opens in a new tab)
  • GHSA-2vc4-c4r6-p6v6High
    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
    • >= 0.3.0, < 1.20.2
    GitHub (opens in a new tab)

    ## Summary When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. `enableCacheInterception` is disabled by default. ## Impact A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware. An application is affected when it: - explicitly ena

    CVE: CVE-2026-100409

  • GHSA-c7mq-gh6q-6q7cHigh
    opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
    • < 1.17.1
    GitHub (opens in a new tab)

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript

    CVE: CVE-2025-6087

  • GHSA-rvpw-p7vw-wj3mHigh
    OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
    • < 1.3.0
    GitHub (opens in a new tab)

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the `/_next/image` endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: `https://victim-site.com/_next/image?url=https://attacker.com`. In this example, attacker-controlled conten

    CVE: CVE-2025-6087

Showing 1-3 of 3 vulnerabilities