CVE-2026-100409 Details

A vulnerability exists in OpenNext Cloudflare, specifically in versions 0.3.0 prior to 1.20.2. When applications enable cache interception, rely on middleware for access control, and have cached protected routes, the handling of percent-encoded pathnames can be inconsistent. This allows an unauthenticated attacker to exploit the vulnerability by using a percent-encoded pathname that bypasses authorization middleware but matches the cache key of a protected route. As a result, cached content is returned without proper authorization. The issue arises because the middleware matching process and cache lookup handle encoded pathnames differently, creating a loophole that can be exploited.

Users should upgrade to OpenNext Cloudflare version 1.20.2 or later. If an immediate upgrade is not possible, cache interception can be disabled, authorization can be enforced within protected route handlers, or encoded paths can be rejected at a trusted proxy before reaching the Cloudflare Worker.