CyberSecBulletin

Opennextjs vulnerabilities

We track 2 vulnerabilities in Opennextjs products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.

2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score

Latest Opennextjs vulnerabilities

  • 7.5 High severity

    opennextjs-cloudflare: Improper Handling of URL Encoding (Hex Encoding)

    CVE-2026-100409Opennextjs

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently

  • 9.1 Critical severity

    Create-cloudflare: Server-Side Request Forgery

    CVE-2025-6087Cloudflare

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remot