CVE-2026-100409

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100409
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100409.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100409
Aliases
Published
2026-10-15T16:57:50Z
Modified
2026-10-28T02:31:09Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
Details

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-177",
        "CWE-180"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100409.json"
}
References

Affected packages

Git / github.com/opennextjs/opennextjs-cloudflare

Affected ranges

Type
GIT
Repo
https://github.com/opennextjs/opennextjs-cloudflare
Events
Introduced
bbba0a8f2e6c911bd73f3245bb7ca893024d07c9
Fixed
da4b7fc8c89441a6f96205635fa70e329d1f0df7
Fixed
38ea40b669be272ddf09a7df7e70c69d0b57404b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.3.0"
                },
                {
                    "fixed": "1.20.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "38ea40b669be272ddf09a7df7e70c69d0b57404b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@opennextjs/cloudflare@0.*
@opennextjs/cloudflare@0.3.0
@opennextjs/cloudflare@0.3.1
@opennextjs/cloudflare@0.3.10
@opennextjs/cloudflare@0.3.2
@opennextjs/cloudflare@0.3.3
@opennextjs/cloudflare@0.3.4
@opennextjs/cloudflare@0.3.5
@opennextjs/cloudflare@0.3.6
@opennextjs/cloudflare@0.3.7
@opennextjs/cloudflare@0.3.8
@opennextjs/cloudflare@0.3.9
@opennextjs/cloudflare@0.4.0
@opennextjs/cloudflare@0.4.1
@opennextjs/cloudflare@0.4.2
@opennextjs/cloudflare@0.4.3
@opennextjs/cloudflare@0.4.4
@opennextjs/cloudflare@0.4.5
@opennextjs/cloudflare@0.4.6
@opennextjs/cloudflare@0.4.7
@opennextjs/cloudflare@0.4.8
@opennextjs/cloudflare@0.5.0
@opennextjs/cloudflare@0.5.1
@opennextjs/cloudflare@0.5.10
@opennextjs/cloudflare@0.5.11
@opennextjs/cloudflare@0.5.12
@opennextjs/cloudflare@0.5.2
@opennextjs/cloudflare@0.5.3
@opennextjs/cloudflare@0.5.4
@opennextjs/cloudflare@0.5.5
@opennextjs/cloudflare@0.5.6
@opennextjs/cloudflare@0.5.7
@opennextjs/cloudflare@0.5.8
@opennextjs/cloudflare@0.5.9
@opennextjs/cloudflare@0.6.0
@opennextjs/cloudflare@0.6.1
@opennextjs/cloudflare@0.6.2
@opennextjs/cloudflare@0.6.3
@opennextjs/cloudflare@0.6.4
@opennextjs/cloudflare@0.6.5
@opennextjs/cloudflare@0.6.6
@opennextjs/cloudflare@1.*
@opennextjs/cloudflare@1.0.0
@opennextjs/cloudflare@1.0.0-beta.0
@opennextjs/cloudflare@1.0.0-beta.1
@opennextjs/cloudflare@1.0.0-beta.2
@opennextjs/cloudflare@1.0.0-beta.3
@opennextjs/cloudflare@1.0.0-beta.4
@opennextjs/cloudflare@1.0.1
@opennextjs/cloudflare@1.0.2
@opennextjs/cloudflare@1.0.3
@opennextjs/cloudflare@1.0.4
@opennextjs/cloudflare@1.1.0
@opennextjs/cloudflare@1.10.0
@opennextjs/cloudflare@1.10.1
@opennextjs/cloudflare@1.11.0
@opennextjs/cloudflare@1.11.1
@opennextjs/cloudflare@1.12.0
@opennextjs/cloudflare@1.13.0
@opennextjs/cloudflare@1.13.1
@opennextjs/cloudflare@1.14.0
@opennextjs/cloudflare@1.14.1
@opennextjs/cloudflare@1.14.10
@opennextjs/cloudflare@1.14.2
@opennextjs/cloudflare@1.14.3
@opennextjs/cloudflare@1.14.4
@opennextjs/cloudflare@1.14.5
@opennextjs/cloudflare@1.14.6
@opennextjs/cloudflare@1.14.7
@opennextjs/cloudflare@1.14.8
@opennextjs/cloudflare@1.14.9
@opennextjs/cloudflare@1.15.0
@opennextjs/cloudflare@1.15.1
@opennextjs/cloudflare@1.16.0
@opennextjs/cloudflare@1.16.1
@opennextjs/cloudflare@1.16.2
@opennextjs/cloudflare@1.16.3
@opennextjs/cloudflare@1.16.4
@opennextjs/cloudflare@1.16.5
@opennextjs/cloudflare@1.16.6
@opennextjs/cloudflare@1.17.0
@opennextjs/cloudflare@1.17.1
@opennextjs/cloudflare@1.17.2
@opennextjs/cloudflare@1.17.3
@opennextjs/cloudflare@1.18.0
@opennextjs/cloudflare@1.18.1
@opennextjs/cloudflare@1.19.0
@opennextjs/cloudflare@1.19.1
@opennextjs/cloudflare@1.19.10
@opennextjs/cloudflare@1.19.11
@opennextjs/cloudflare@1.19.2
@opennextjs/cloudflare@1.19.3
@opennextjs/cloudflare@1.19.4
@opennextjs/cloudflare@1.19.5
@opennextjs/cloudflare@1.19.6
@opennextjs/cloudflare@1.19.7
@opennextjs/cloudflare@1.19.8
@opennextjs/cloudflare@1.19.9
@opennextjs/cloudflare@1.2.0
@opennextjs/cloudflare@1.2.1
@opennextjs/cloudflare@1.20.0
@opennextjs/cloudflare@1.20.1
@opennextjs/cloudflare@1.3.0
@opennextjs/cloudflare@1.3.1
@opennextjs/cloudflare@1.4.0
@opennextjs/cloudflare@1.5.0
@opennextjs/cloudflare@1.5.1
@opennextjs/cloudflare@1.5.2
@opennextjs/cloudflare@1.5.3
@opennextjs/cloudflare@1.6.0
@opennextjs/cloudflare@1.6.1
@opennextjs/cloudflare@1.6.2
@opennextjs/cloudflare@1.6.3
@opennextjs/cloudflare@1.6.4
@opennextjs/cloudflare@1.6.5
@opennextjs/cloudflare@1.7.0
@opennextjs/cloudflare@1.7.1
@opennextjs/cloudflare@1.8.0
@opennextjs/cloudflare@1.8.1
@opennextjs/cloudflare@1.8.2
@opennextjs/cloudflare@1.8.3
@opennextjs/cloudflare@1.8.4
@opennextjs/cloudflare@1.8.5
@opennextjs/cloudflare@1.9.0
@opennextjs/cloudflare@1.9.1
@opennextjs/cloudflare@1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100409.json"