{"metadata": {"vulnerability": "cve-2025-6087", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2025-06-14T02:12:00.423Z", "date_only": false, "value": "2025-06-14T02:12:00.423Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-6087", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-06-15T06:00:00Z", "date_only": false, "value": "2025-06-15T06:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cloudflare", "record": "cve-2025-6087", "field": "containers.cna.datePublic"}, {"timestamp": "2025-06-16T18:30:44.180Z", "date_only": false, "value": "2025-06-16T18:30:44.180Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-6087", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-06-16T18:30:44.180Z", "date_only": false, "value": "2025-06-16T18:30:44.180Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cloudflare", "record": "cve-2025-6087", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-16T18:55:28.409Z", "date_only": false, "value": "2025-06-16T18:55:28.409358Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-6087", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-06-16T18:55:28.409Z", "date_only": false, "value": "2025-06-16T18:55:28.409358Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6087", "record": "FKIE_CVE-2025-6087", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-06-16T18:55:53.269Z", "date_only": false, "value": "2025-06-16T18:55:53.269Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-6087", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-06-16T18:55:53.269Z", "date_only": false, "value": "2025-06-16T18:55:53.269Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-6087", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-16T19:15:33Z", "date_only": false, "value": "2025-06-16T19:15:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RVPW-P7VW-WJ3M", "record": "GHSA-RVPW-P7VW-WJ3M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-06-16T19:15:33.837Z", "date_only": false, "value": "2025-06-16T19:15:33.837", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6087", "record": "FKIE_CVE-2025-6087", "field": "published"}, {"timestamp": "2025-06-16T19:25:01.314Z", "date_only": false, "value": "2025-06-16T19:25:01.314239Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114694678161147224", "record": "CVE-2025-6087", "field": "creation_timestamp", "uuid": "ef20597f-5209-43ef-b8dc-28a5e7916a18", "url": "https://infosec.exchange/users/cR0w/statuses/114694678161147224"}, {"timestamp": "2025-06-16T19:37:16Z", "date_only": false, "value": "2025-06-16T19:37:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RVPW-P7VW-WJ3M", "record": "GHSA-RVPW-P7VW-WJ3M", "field": "published"}, {"timestamp": "2025-06-16T19:41:02Z", "date_only": false, "value": "2025-06-16T19:41:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/18520", "record": "CVE-2025-6087", "field": "creation_timestamp", "uuid": "f8fedc5a-9aa3-4ac6-9d7c-c68be5fb0f54", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6087\n\ud83d\udd25 CVSS Score: 7.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N)\n\ud83d\udd39 Description: A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n  *  SSRF via unrestricted remote URL loading\n\n\n\n\n  *  Arbitrary remote content loading\n\n\n\n\n  *  Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n  *  Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets.\n\ud83d\udccf Published: 2025-06-16T18:30:44.180Z\n\ud83d\udccf Modified: 2025-06-16T18:55:53.269Z\n\ud83d\udd17 References:\n1. https://github.com/opennextjs/opennextjs-cloudflare", "url": "https://t.me/DarkWebInformer_CVEAlerts/18520"}, {"timestamp": "2025-06-16T21:46:51Z", "date_only": false, "value": "2025-06-16T21:46:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RVPW-P7VW-WJ3M", "record": "GHSA-RVPW-P7VW-WJ3M", "field": "modified"}, {"timestamp": "2025-06-19T03:14:52.086Z", "date_only": false, "value": "2025-06-19T03:14:52.086954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lrwkn2urjr2s", "record": "CVE-2025-6087", "field": "creation_timestamp", "uuid": "7fc66a47-c060-4b66-ac4b-63bbf4ce48ad", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lrwkn2urjr2s"}, {"timestamp": "2025-06-25T17:32:53.060Z", "date_only": false, "value": "2025-06-25T17:32:53.060302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/geeknik.bsky.social/post/3lsh5ettopp2o", "record": "CVE-2025-6087", "field": "creation_timestamp", "uuid": "9fa23e2d-b1ef-4ef1-b665-ba49e0b9db32", "url": "https://bsky.app/profile/geeknik.bsky.social/post/3lsh5ettopp2o"}, {"timestamp": "2026-06-17T10:01:07.517Z", "date_only": false, "value": "2026-06-17T10:01:07.517", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6087", "record": "FKIE_CVE-2025-6087", "field": "lastModified"}]}