opennextjs
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| opennextjs-cloudflare | 1 | – | Oct 15, 2026 |
| @opennextjs/cloudflare | 1 | – | Mar 4, 2026 |
Exploited and recent CVEs
- CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths 0.5%
- CVE-2026-3125 SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass 0.4%