Key points
- CVE-2026-100409 affects @opennextjs/cloudflare versions 0.3.0 through 1.20.1.
- The vulnerability requires enableCacheInterception to be explicitly enabled.
- Version 1.20.2 patches the issue by aligning path handling logic.
The npm package @opennextjs/cloudflare contains a high-severity vulnerability identified as CVE-2026-100409. The flaw exists in versions greater than or equal to 0.3.0 and less than 1.20.2. According to the GitHub advisory GHSA-2vc4-c4r6-p6v6, version 1.20.2 resolves the issue. Security teams should verify their current installations immediately to determine if they fall within the vulnerable range.
In plain English
This bug allows unauthenticated attackers to view protected content. It happens because the system handles URL encoding differently for middleware checks versus cache lookups. If an attacker sends a percent-encoded request, the middleware may not recognize it as a protected path. However, the cache system decodes the URL and serves the cached protected page anyway. This bypasses the intended security controls.
The background
The issue arises only when developers explicitly enable `enableCacheInterception`. This feature is disabled by default in the package. For the vulnerability to be exploitable, the application must also rely on middleware for access control and have a matching cached route. The mismatch occurs because middleware matching previously used the encoded pathname, while cache interception decoded the pathname before selecting a cache entry.
What changes now
The vendor has released version 1.20.2 to fix the inconsistency. The update aligns encoded-path handling across middleware matching and cache lookup processes. It also rejects malformed paths instead of processing them partially. Applications using the vulnerable versions must upgrade to 1.20.2 or later to mitigate the risk. No other patches or workarounds are mentioned in the advisory.
Who needs to act first
Teams should prioritize updating systems that have cache interception enabled. Check your configuration files to see if this feature is active. If it is, update the package immediately after testing in a non-production environment. Back up your current configuration before making changes. If you cannot update right away, consider disabling cache interception temporarily to reduce exposure. Monitor logs for unusual cache hits on protected routes while you plan the upgrade.
What to do and how to stay safe: @opennextjs/cloudflare
- Audit your npm dependencies to identify if you are using a vulnerable version of @opennextjs/cloudflare.
- Verify whether `enableCacheInterception` is set to true in your Cloudflare configuration files.
- Update to version 1.20.2 or later once the vendor provides the stable release.
- Review access logs for suspicious requests containing percent-encoded characters targeting protected routes.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability enabled by default?
No, the vulnerability requires `enableCacheInterception` to be explicitly enabled, which is disabled by default.
What is the CVE ID for this issue?
The CVE ID is CVE-2026-100409.
Which versions are affected?
Versions greater than or equal to 0.3.0 and less than 1.20.2 are affected.
