OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Summary When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached respon...

CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409

The OpenNext Cloudflare adapter (versions 0.3.0 through 1.20.2 ) is vulnerable to an authorization bypass when enableCacheInterception is active. The root cause is an inconsistency in how encoded pathnames are processed between middleware matching and cache lookup. An unauthenticated attacker can...