opennextjs CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH opennextjs CVE published 2026-10-15

CVE-2026-100409

CVE-2026-100409: OpenNext Cloudflare Cache Interception Bypass. The `@opennextjs/cloudflare` package has a vulnerability where cache interception can bypass middleware protection for encoded paths. When cache interception is enabled, the package can interpret percent-encoded paths differently during middleware matching and cache lookup. This can lead to a remote unauthenticated attacker retrieving cached [truncated]