{"action":"Upgrade @opennextjs/cloudflare to 1.17.1 or later.","affected":[{"fixed":"1.17.1","introduced":"0"}],"component":"@opennextjs/cloudflare","cve_ids":["CVE-2025-6087","CVE-2026-3125"],"ecosystem":"npm","epss":0.00967,"exploited":false,"fixed_versions":["1.17.1"],"ghsa_id":"GHSA-c7mq-gh6q-6q7c","id":"tcs_01M5KFJ3HF13ZEPCER2XXGYA6E","modified_at":"2026-03-16T03:05:38.239106Z","published_at":"2026-03-05T00:57:07Z","references":["https://osv.dev/vulnerability/GHSA-c7mq-gh6q-6q7c","https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-c7mq-gh6q-6q7c","https://nvd.nist.gov/vuln/detail/CVE-2026-3125","https://github.com/opennextjs/opennextjs-cloudflare/pull/1147","https://github.com/opennextjs/opennextjs-cloudflare/commit/f5bd138fd3c77e02f2aa4b9c76d55681e59e98b4","https://github.com/advisories/GHSA-rvpw-p7vw-wj3m","https://github.com/opennextjs/opennextjs-cloudflare","https://www.cve.org/cverecord?id=CVE-2025-6087","https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.17.1"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-c7mq-gh6q-6q7c","url":"https://osv.dev/vulnerability/GHSA-c7mq-gh6q-6q7c"},{"source":"nvd","source_id":"CVE-2025-6087","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6087"}],"summary":"opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass"}