CVE-2026-100409
Deferred Deferred - Pending Action

Path Traversal in OpenNext Cloudflare Adapter

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-100409
EUVD
EUVD-2026-102200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opennextjs opennextjs-cloudflare >= 0.3.0, < 1.20.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
CWE-177 The product does not properly handle when all or part of an input has been URL encoded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenNext Cloudflare versions 0.3.0 to 1.20.1. When cache interception is enabled and middleware handles access control, encoded pathnames are processed inconsistently. An attacker can exploit this by using a percent-encoded pathname that bypasses middleware authorization but decodes to a protected route's cache key. This causes cached content to be returned without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your OpenNext Cloudflare application uses versions between 0.3.0 and 1.20.1 and has enableCacheInterception enabled. Review middleware configurations for routes like /admin/:path* and test encoded paths such as /%61dmin to see if they bypass authorization.

Impact Analysis

An unauthenticated attacker could access protected cached routes without authorization by crafting encoded pathnames. This could lead to unauthorized data exposure or access to sensitive content. The impact is high severity with a CVSS score of 7.5 due to potential unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (unauthorized access to personal data) and HIPAA (unauthorized access to protected health information).

Mitigation Strategies

Upgrade to version 1.20.2 or later of @opennextjs/cloudflare. Disable cache interception if upgrading is not possible. Enforce authorization in route handlers and reject encoded paths at a trusted proxy level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart