npm/@opennextjs/cloudflare CVE-2025-6087, CVE-2026-3125: high, EPSS 0.97%

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

Action: Upgrade @opennextjs/cloudflare to 1.3.0 or later.

npm i @opennextjs/cloudflare@1.3.0

Affected

Fixed versions

Sources

• osv: GHSA-rvpw-p7vw-wj3m
• https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-rvpw-p7vw-wj3m
• https://nvd.nist.gov/vuln/detail/CVE-2025-6087
• https://github.com/cloudflare/workers-sdk/pull/9608
• https://github.com/opennextjs/opennextjs-cloudflare/pull/727
• https://github.com/opennextjs/opennextjs-cloudflare/commit/36119c0f490c95b3d4f6e826d745b728c80625ab
• https://github.com/opennextjs/opennextjs-cloudflare

CVE-2025-6087, CVE-2026-3125 · published 2025-06-16T19:37:16Z · modified 2026-03-16T03:05:28.307271Z · JSON