CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409

The OpenNext Cloudflare adapter (versions 0.3.0 through 1.20.2 ) is vulnerable to an authorization bypass when enableCacheInterception is active. The root cause is an inconsistency in how encoded pathnames are processed between middleware matching and cache lookup. An unauthenticated attacker can...

CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

EUVD-2026-102200

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409: Improper Handling of URL Encoding (Hex Encoding)

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

PT-2026-115014

Name of the Vulnerable Software and Affected Versions OpenNext Cloudflare versions 0.3.0 through 1.20.1 Description Applications that enable enableCacheInterception and rely on middleware for access control are subject to inconsistent processing of encoded pathnames between middleware matching an...