{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopennextopennextjs_cloudflare/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opennext:opennextjs_cloudflare:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-100409"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@opennextjs/cloudflare (\u003e= 0.3.0, \u003c 1.20.2)"],"_cs_severities":["high"],"_cs_tags":["web-application","middleware-bypass","cloudflare","cve-2026-100409"],"_cs_type":"advisory","_cs_vendors":["OpenNext"],"content_html":"\u003cp\u003eA security vulnerability exists in \u003ccode\u003e@opennextjs/cloudflare\u003c/code\u003e versions 0.3.0 through 1.20.1 due to inconsistent percent-encoded path handling when the \u003ccode\u003eenableCacheInterception\u003c/code\u003e feature is activated. When enabled, the library performs path decoding during cache lookup that differs from the decoding logic used by middleware matchers.\u003c/p\u003e\n\u003cp\u003eThis discrepancy allows an attacker to craft a request with percent-encoded characters that effectively hide the path from security middleware, while subsequently being normalized into a valid cache key that points to a protected resource. Because the middleware fails to trigger, the authorization check is skipped entirely, and the Cloudflare Worker serves the cached response directly to the unauthenticated user. The vulnerability also stems from a secondary issue where malformed segments are partially decoded rather than rejected, allowing for potential obfuscation. This flaw impacts applications relying on middleware for sensitive access control in conjunction with static asset caching.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows remote unauthenticated attackers to bypass intended access control mechanisms, resulting in the unauthorized retrieval of cached data from protected routes. The impact is limited to applications that explicitly enable \u003ccode\u003eenableCacheInterception\u003c/code\u003e and utilize middleware as their primary authorization gatekeeper. No specific victim counts are documented, but the scope includes all deployments of the affected \u003ccode\u003e@opennextjs/cloudflare\u003c/code\u003e package that meet these specific configuration criteria.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@opennextjs/cloudflare\u003c/code\u003e to version 1.20.2 or later to address CVE-2026-100409.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, disable the \u003ccode\u003eenableCacheInterception\u003c/code\u003e setting in the \u003ccode\u003edefineCloudflareConfig\u003c/code\u003e object.\u003c/li\u003e\n\u003cli\u003eImplement authorization logic directly within route handlers as a defense-in-depth measure, rather than relying solely on middleware.\u003c/li\u003e\n\u003cli\u003eValidate and reject anomalous encoded paths at the edge using Cloudflare WAF rules before the request reaches the Worker environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:24:22Z","date_published":"2026-10-15T22:24:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-opennext-cache-bypass/","summary":"The @opennextjs/cloudflare component contains a vulnerability (CVE-2026-100409) where inconsistent path decoding allows attackers to bypass middleware-based authorization and retrieve cached content.","title":"OpenNext Cloudflare Middleware Bypass via Cache Interception","url":"https://feed.craftedsignal.io/briefs/2026-10-opennext-cache-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:opennext:opennextjs_cloudflare:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}