Executive brief
OpenNextJS Cloudflare is a Next.js adapter that deploys applications to Cloudflare Workers. An attacker can bypass Cloudflare's edge security by using backslash characters in URLs, causing the system to fetch and serve arbitrary remote content under the victim's domain. This violates security boundaries and could expose sensitive cached data, mislead users, or enable attackers to abuse infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the @opennextjs/cloudflare package due to path normalization bypass in the /cdn-cgi/image/ handler. The vulnerability exploits a mismatch between edge-level filtering (which blocks /cdn-cgi/ requests) and client-side URL parsing: attackers substitute backslashes for forward slashes (e.g., /cdn-cgi\image/) to bypass Cloudflare's edge interception. The JavaScript URL class normalizes the backslash to a forward slash after reaching the Worker, causing the request to match the handler and trigger an unvalidated fetch of attacker-controlled URLs. The attack requires HTTP clients that preserve backslashes (e.g., curl --path-as-is); browsers normalize them before sending. Additionally, Cloudflare Workers with Assets and Pages are vulnerable to the same bypass, potentially exposing private assets stored under /cdn-cgi/ paths such as incremental cache data. Patches are available in @opennextjs/cloudflare version 1.17.1 and above, and Cloudflare has deployed platform-level mitigations to block backslash normalization bypasses.
Affected products
- OpenNextJS Cloudflare < 1.17.1
CVE identifiers
- CVE-2025-6087
- CVE-2026-3125
Timeline
- 2026-03-04: disclosed: Advisory published
- 2026-03-05: patched: Patched version 1.17.1 released; Cloudflare platform-level mitigations deployed