{"action":"Upgrade @opennextjs/cloudflare to 1.20.2 or later.","affected":[{"fixed":"1.20.2","introduced":"0.3.0"}],"component":"@opennextjs/cloudflare","cve_ids":["CVE-2026-100409"],"ecosystem":"npm","exploited":false,"fixed_versions":["1.20.2"],"ghsa_id":"GHSA-2vc4-c4r6-p6v6","id":"tcs_01M5JHG6FX047GYT9NNBBMNFMA","modified_at":"2026-10-15T20:30:05.349670038Z","published_at":"2026-10-15T20:15:17Z","references":["https://osv.dev/vulnerability/GHSA-2vc4-c4r6-p6v6","https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6","https://nvd.nist.gov/vuln/detail/CVE-2026-100409","https://github.com/opennextjs/opennextjs-aws/pull/1199","https://github.com/opennextjs/opennextjs-aws/pull/1200","https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b","https://github.com/opennextjs/opennextjs-cloudflare","https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2vc4-c4r6-p6v6","url":"https://osv.dev/vulnerability/GHSA-2vc4-c4r6-p6v6"}],"summary":"OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths"}