High 7.7Published Mar 4, 2026

CVE-2026-3125SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass

Updated under an hour ago (Oct 26, 2026, 9:40 PM ET)

Does this affect you?

It affects opennextjs @opennextjs/cloudflare and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for opennextjs @opennextjs/cloudflare

Exploited in the last 30 days

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs. For example: https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com In this example, attacker-controlled content from attacker.com is served through the victim site's domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services. Note: This bypass only works via HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is). Browsers normalize backslashes to forward slashes before sending requests. Additionally, Cloudflare Workers with Assets and Cloudflare Pages suffer from a similar vulnerability. Assets stored under /cdn-cgi/ paths are not publicly accessible under normal conditions. However, using the same backslash bypass (/cdn-cgi\... instead of /cdn-cgi/...), these assets become publicly accessible. This could be used to retrieve private data. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

CVSS: 7.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N
Weakness (CWE): CWE-918, CWE-706
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: cloudflare
NVD analysis: Analyzed
Record last updated: Mar 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

opennextjs @opennextjs/cloudflare opennextjs:cloudflare (from the name)	before 1.17.1	CNA record
opennextjs opennext_for_cloudflare opennextjs:opennext_for_cloudflare	before 1.17.1	NVD

References

References

https://github.com/opennextjs/opennextjs-cloudflare/pull/1147	patch, issue-tracking
https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.17.1	product, release-notes
https://github.com/advisories/GHSA-rvpw-p7vw-wj3m	related, third-party-advisory
https://www.cve.org/cverecord?id=CVE-2025-6087	related, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.