Mmastodon Technology Cybersecurity first seen 2 d ago, last 2 d ago, peak #2

Cloudflare's Next.js adapter hit by auth bypass flaw

Original: CVE-2026-100409 affects OpenNextJS @opennextjs/cloudflare, the Next.js adapter for Cloudflare. Versions 0.3.0 through ea

A vulnerability tracked as CVE-2026-100409 affects @opennextjs/cloudflare, the adapter that lets Next.js applications run on Cloudflare. Versions 0.3.0 through anything earlier than 1.20.2 can serve cached protected content to unauthenticated users via percent-encoded paths that slip past authorization middleware. Users are being urged to upgrade to 1.20.2 or later.

Why now: Developers running Next.js on Cloudflare need to patch quickly to avoid leaking protected content.

Cloudflare OpenNextJS Next.js CVE-2026-100409

Open on mastodon →

Evidence

CVE-2026-100409 affects OpenNextJS @opennextjs/cloudflare, the Next.js adapter for Cloudflare. Versions 0.3.0 through earlier than 1.20.2 can serve cached protected content to unauthenticated requests through percent-encoded paths that bypass authorization middleware. Upgrade… · suriq@infosec.exchange · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/2384163