CVE-2026-100409: OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.
enableCacheInterception is disabled by default.
References
- github.com/advisories/GHSA-2vc4-c4r6-p6v6
- github.com/opennextjs/opennextjs-aws/pull/1199
- github.com/opennextjs/opennextjs-aws/pull/1200
- github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b
- github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2
- github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6
- nvd.nist.gov/vuln/detail/CVE-2026-100409
Code Behaviors & Features
Detect and mitigate CVE-2026-100409 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →