npm/@opennextjs/cloudflare CVE-2025-6087, CVE-2026-3125: critical 9.1, EPSS 0.97%

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

Action: Upgrade @opennextjs/cloudflare to 1.17.1 or later.

npm i @opennextjs/cloudflare@1.17.1

Affected

Fixed versions

Sources

• osv: GHSA-c7mq-gh6q-6q7c
• nvd: CVE-2025-6087
• https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-c7mq-gh6q-6q7c
• https://nvd.nist.gov/vuln/detail/CVE-2026-3125
• https://github.com/opennextjs/opennextjs-cloudflare/pull/1147
• https://github.com/opennextjs/opennextjs-cloudflare/commit/f5bd138fd3c77e02f2aa4b9c76d55681e59e98b4
• https://github.com/advisories/GHSA-rvpw-p7vw-wj3m
• https://github.com/opennextjs/opennextjs-cloudflare
• https://www.cve.org/cverecord?id=CVE-2025-6087
• https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.17.1

CVE-2025-6087, CVE-2026-3125 · published 2026-03-05T00:57:07Z · modified 2026-03-16T03:05:38.239106Z · JSON