Server-Side Request Forgery Vulnerability in Open Next.js Cloudflare Package

CVE-2026-3125

What is CVE-2026-3125?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the @opennextjs/cloudflare package due to a path normalization bypass. This issue occurs within the /cdn-cgi/image/ handler, which is intended for development use. In production scenarios, Cloudflare's edge typically intercepts requests meant for this handler. However, an attacker can exploit this vulnerability by substituting a backslash for a forward slash in the request path, allowing it to bypass the edge interception and reach the Worker directly. When the request is processed, the JavaScript URL class normalizes the backslash to a forward slash, triggering an unvalidated fetch of arbitrary remote URLs, thereby violating the same-origin policy. This can lead to the serving of attacker-controlled content through the victim's domain. Furthermore, this vulnerability extends to Cloudflare Workers with Assets and Cloudflare Pages, where the same backslash bypass can expose private assets that are normally inaccessible.

References