CVE-2026-100409 opennextjs CVE debrief

Who should care

Defenders responsible for applications using `@opennextjs/cloudflare` with cache interception enabled and middleware for access control should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-100409 allows unauthorized access to cached content when cache interception is enabled in `@opennextjs/cloudflare`. Defenders should verify cache and middleware configurations to prevent exposure.

• Potential unauthorized access to cached content
• Bypass of middleware protection for encoded paths
• Exposure of sensitive information
• Need for verification of cache interception and middleware configuration

Technical summary

The `@opennextjs/cloudflare` package has a vulnerability where cache interception can bypass middleware protection for encoded paths. When cache interception is enabled, the package can interpret percent-encoded paths differently during middleware matching and cache lookup. This can lead to a remote unauthenticated attacker retrieving cached content from routes intended to be protected by middleware.

Defensive priority

Defenders should prioritize verifying if their applications use `@opennextjs/cloudflare` with cache interception enabled and rely on middleware for access control. They should check for matching cached routes and assess exposure to unauthorized access.

Recommended defensive actions

• Verify if `@opennextjs/cloudflare` is used with cache interception enabled
• Check if middleware is used for access control
• Assess if there are matching cached routes
• Update to version 1.20.2 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in `@opennextjs/cloudflare`. Cache interception can bypass middleware protection for encoded paths when enabled. The impact is that a remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.