npmPackage

@opennextjs/cloudflare

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-100409High 7.5
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
Affected: from 0.3.0, fixed in 1.20.2.
Fixed in 1.20.2 (released Jul 21, 2026, 86 days before disclosure).
The latest release, 1.20.16, is not affected.
24% of @opennextjs/cloudflare downloads last week were affected versions (580.2K).
CVE-2026-3125High 7.7
SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass
Affected: fixed in 1.17.1; fixed in 1.3.0; fixed in 1.17.1.
Fixed in 1.17.1 (released Feb 24, 2026, 8 days before disclosure).
The latest release, 1.20.16, is not affected.
6.5% of @opennextjs/cloudflare downloads last week were affected versions (158.4K).
CVE-2025-6087High 7.8
SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
Affected: fixed in 1.3.0; fixed in 1.17.1.
Fixed in 1.17.1 (released Feb 24, 2026, 253 days after disclosure).
The latest release, 1.20.16, is not affected.
6.5% of @opennextjs/cloudflare downloads last week were affected versions (158.4K).