CVE-2026-100409High· 7.5▾ TwilightOpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@opennextjs/cloudflare >= 0.3.0, < 1.20.2Patched in:
@opennextjs/cloudflare 1.20.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-93630Medium· 4.3Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
CVE-2026-114622High· 7.2baserCMS: Encoded path traversal bypass in the theme file API
CVE-2026-112003Medium· 5.9ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
CVE-2026-110846High· 7.0n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form
CVE-2022-27780High· 7.5The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example…