Vulnerability-Lookup

CVE-2026-100409 (GCVE-0-2026-100409)

Vulnerability from cvelistv5 – Published: 2026-10-15 16:57 – Updated: 2026-10-15 17:50

Title

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Summary

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 17:50 UTC

CWE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)
CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/opennextjs/opennextjs-cloudfla…	x_refsource_CONFIRM
https://github.com/opennextjs/opennextjs-aws/pull/1199	x_refsource_MISC
https://github.com/opennextjs/opennextjs-aws/pull/1200	x_refsource_MISC
https://github.com/opennextjs/opennextjs-cloudfla…	x_refsource_MISC
https://github.com/opennextjs/opennextjs-cloudfla…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
opennextjs	opennextjs-cloudflare	Affected: >= 0.3.0, < 1.20.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T17:50:22.601978Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T17:50:33.255Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opennextjs-cloudflare",
          "vendor": "opennextjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 1.20.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "CWE-177: Improper Handling of URL Encoding (Hex Encoding)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T16:57:50.999Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
        },
        {
          "name": "https://github.com/opennextjs/opennextjs-aws/pull/1199",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
        },
        {
          "name": "https://github.com/opennextjs/opennextjs-aws/pull/1200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
        },
        {
          "name": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
        },
        {
          "name": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2vc4-c4r6-p6v6",
        "discovery": "UNKNOWN"
      },
      "title": "OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100409",
    "datePublished": "2026-10-15T16:57:50.999Z",
    "dateReserved": "2026-09-25T20:08:33.084Z",
    "dateUpdated": "2026-10-15T17:50:33.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "opennextjs-cloudflare",
                "vendor": "opennextjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.3.0, \u003c 1.20.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2."
          }
        ],
        "id": "CVE-2026-100409",
        "lastModified": "2026-10-15T18:17:21.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-100409",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T17:50:22.601978Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-15T17:17:07.923",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-177"
              },
              {
                "lang": "en",
                "value": "CWE-180"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-100409",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T17:50:22.601978Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T17:50:28.225Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "opennextjs-cloudflare",
              "vendor": "opennextjs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.3.0, \u003c 1.20.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-177",
                  "description": "CWE-177: Improper Handling of URL Encoding (Hex Encoding)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-180",
                  "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-15T16:57:50.999Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
            },
            {
              "name": "https://github.com/opennextjs/opennextjs-aws/pull/1199",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
            },
            {
              "name": "https://github.com/opennextjs/opennextjs-aws/pull/1200",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
            },
            {
              "name": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
            },
            {
              "name": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
            }
          ],
          "source": {
            "advisory": "GHSA-2vc4-c4r6-p6v6",
            "discovery": "UNKNOWN"
          },
          "title": "OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-100409",
        "datePublished": "2026-10-15T16:57:50.999Z",
        "dateReserved": "2026-09-25T20:08:33.084Z",
        "dateUpdated": "2026-10-15T17:50:33.255Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-100409

Vulnerability from fkie_nvd - Published: 2026-10-15 17:17 - Updated: 2026-10-15 18:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/opennextjs/opennextjs-aws/pull/1199
	security-advisories@github.com	https://github.com/opennextjs/opennextjs-aws/pull/1200
	security-advisories@github.com	https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b
	security-advisories@github.com	https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2
	security-advisories@github.com	https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opennextjs-cloudflare",
          "vendor": "opennextjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 1.20.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2."
    }
  ],
  "id": "CVE-2026-100409",
  "lastModified": "2026-10-15T18:17:21.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-100409",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T17:50:22.601978Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-15T17:17:07.923",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-177"
        },
        {
          "lang": "en",
          "value": "CWE-180"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2VC4-C4R6-P6V6

Vulnerability from github – Published: 2026-10-15 20:15 – Updated: 2026-10-15 20:15

Summary

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Details

Summary

When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup.

An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.

enableCacheInterception is disabled by default.

Impact

A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.

An application is affected when it:

explicitly enables enableCacheInterception;
relies on middleware for access control; and
has a matching cached route.

Details

Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.

For example, consider an application with:

middleware matcher /admin/:path*;
middleware returning 401 Authentication required for /admin;
a statically generated, cached /admin route; and
cache interception enabled:

export default defineCloudflareConfig({
  incrementalCache: staticAssetsIncrementalCache,
  enableCacheInterception: true,
});

An attacker can request:

GET /%61dmin

The encoded pathname does not match /admin/:path*, so the authorization middleware is not invoked. Cache interception then decodes %61dmin to admin and may return the cached /admin response:

HTTP/1.1 200 OK
x-opennext-cache: HIT

Protected content

Malformed paths exposed an additional inconsistency. For example:

GET /%61dmin/%ZZ

The previous implementation decoded each segment independently. It decoded %61dmin to admin but retained the malformed %ZZ segment, allowing cache lookup to continue using a partially decoded pathname.

Patches

The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in opennextjs-aws#1199 and opennextjs-aws#1200.

Users should upgrade to @opennextjs/cloudflare@1.20.2 or later.

Workarounds

If upgrading is not immediately possible for an application:

Disable cache interception by removing enableCacheInterception: true.
Enforce authorization inside protected route handlers rather than relying exclusively on middleware.
Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.

Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opennextjs/cloudflare"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "1.20.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-100409"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-177",
      "CWE-180"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:15:17Z",
    "nvd_published_at": "2026-10-15T17:17:07Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nWhen cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.\n\nAn encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.\n\n`enableCacheInterception` is disabled by default.\n\n## Impact\n\nA remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.\n\nAn application is affected when it:\n\n- explicitly enables `enableCacheInterception`;\n- relies on middleware for access control; and\n- has a matching cached route.\n\n## Details\n\nMiddleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.\n\nFor example, consider an application with:\n\n- middleware matcher `/admin/:path*`;\n- middleware returning `401 Authentication required` for `/admin`;\n- a statically generated, cached `/admin` route; and\n- cache interception enabled:\n\n```ts\nexport default defineCloudflareConfig({\n  incrementalCache: staticAssetsIncrementalCache,\n  enableCacheInterception: true,\n});\n```\n\nAn attacker can request:\n\n```http\nGET /%61dmin\n```\n\nThe encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:\n\n```http\nHTTP/1.1 200 OK\nx-opennext-cache: HIT\n\nProtected content\n```\n\nMalformed paths exposed an additional inconsistency. For example:\n\n```http\nGET /%61dmin/%ZZ\n```\n\nThe previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.\n\n## Patches\n\nThe fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).\n\nUsers should upgrade to `@opennextjs/cloudflare@1.20.2` or later.\n\n## Workarounds\n\nIf upgrading is not immediately possible for an application:\n\n1. Disable cache interception by removing `enableCacheInterception: true`.\n2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.\n3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.\n\nAdding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.",
  "id": "GHSA-2vc4-c4r6-p6v6",
  "modified": "2026-10-15T20:15:17Z",
  "published": "2026-10-15T20:15:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100409"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-100409 (GCVE-0-2026-100409)

FKIE_CVE-2026-100409

GHSA-2VC4-C4R6-P6V6

Summary

Impact

Details

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour