opennextjs/opennextjs-cloudflare Security Advisories | GitStock

high2026-10-15

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

GHSA-2vc4-c4r6-p6v6 · CVE-2026-100409

high2026-03-05

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

GHSA-c7mq-gh6q-6q7c · CVE-2026-3125

high2025-06-16

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

GHSA-rvpw-p7vw-wj3m · CVE-2025-6087