CVE-2026-100409: OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.
enableCacheInterception is disabled by default.
References
- github.com/advisories/GHSA-2vc4-c4r6-p6v6
- github.com/opennextjs/opennextjs-aws/pull/1199
- github.com/opennextjs/opennextjs-aws/pull/1200
- github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b
- github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2
- github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6
- nvd.nist.gov/vuln/detail/CVE-2026-100409
Code Behaviors & Features
Detect and mitigate CVE-2026-100409 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →