OpenNextJS

A vulnerability tracked as CVE-2026-100409 affects @opennextjs/cloudflare, the adapter that lets Next.js applications run on Cloudflare. Versions 0.3.0 through anything earlier than 1.20.2 can serve cached protected content to unauthenticated users via percent-encoded paths that slip past authorization middleware. Users are being urged to upgrade to 1.20.2 or later.