CVE-2026-100409 in OpenNext
Summary
by MITRE • 10/15/2026
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within OpenNext Cloudflare versions ranging from 0.3.0 through 1.20.2 represents a critical logic flaw in how the adapter handles URL encoding during cache interception and middleware execution. This issue specifically affects applications that utilize the enableCacheInterception feature alongside middleware for access control mechanisms. The core of the problem lies in an inconsistency between how the middleware layer processes incoming request pathnames versus how the caching system generates or retrieves cache keys based on those same paths. In a secure architecture, these two components must operate with identical parsing logic to ensure that authorization checks are accurately applied before any cached content is served. When this consistency breaks down, it creates an opportunity for unauthorized access through manipulation of URL encoding schemes.
An unauthenticated attacker can exploit this discrepancy by crafting requests containing percent-encoded pathnames that appear distinct from protected routes when processed by the middleware but resolve to identical cache keys when processed by the caching layer. For instance, a request might use double-encoding or non-standard character representations in the URI path. The middleware evaluates these encoded characters and determines that the requested resource does not require authentication because it perceives the path as safe or public. However, the underlying Cloudflare edge network processes the cache lookup using a different decoding standard or normalization routine. This causes the system to retrieve cached content intended for a protected route, effectively bypassing the authorization middleware entirely. The attacker receives sensitive data that was previously stored in the cache without having passed through the necessary security checks.
Furthermore, the vulnerability extends beyond simple percent-encoding mismatches to include malformed encodings that are only partially decoded by different components of the stack. This partial decoding allows an attacker to construct pathnames where certain segments remain encoded during middleware evaluation while being fully or differently interpreted during cache lookup operations. This inconsistency enables attackers to probe for protected resources and retrieve their cached responses even when direct access is denied. The impact of this flaw is significant, as it undermines the fundamental security model of web applications relying on edge caching combined with server-side authentication logic. Sensitive information such as user-specific data, administrative interfaces, or proprietary content can be exposed to any internet-facing client without valid credentials.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the cached content contains sensitive session tokens or API keys that were inadvertently stored in public caches due to this bypass. From an ATT&CK perspective, this behavior facilitates unauthorized access (T1078) by exploiting a misconfiguration in how input is normalized across different system components. It also relates to cache poisoning concepts where an attacker manipulates the state of shared resources, although here it is more accurately described as a logic flaw leading to information disclosure rather than active injection of malicious content into the cache itself. The root cause is not a failure in encryption or network security protocols but rather a fundamental design oversight in handling URI normalization across distributed systems layers.
The recommended mitigation for this issue is straightforward and has already been implemented by the maintainers of OpenNext Cloudflare. Organizations running affected versions must upgrade to version 1.20.2 or later, where the inconsistency between middleware pathname matching and cache key generation has been resolved. Until an update can be applied, administrators should consider disabling enableCacheInterception if it is not strictly necessary for performance requirements, thereby removing the attack surface associated with this specific logic flaw. Additionally, implementing strict input validation at the application level to normalize all incoming URIs before they reach either middleware or caching layers may provide a temporary defensive measure, though upgrading remains the only complete solution. Regular security audits of adapter configurations and cache policies are essential to prevent similar discrepancies in other parts of the infrastructure.