{"action":"Upgrade @opennextjs/cloudflare to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"@opennextjs/cloudflare","cve_ids":["CVE-2025-6087","CVE-2026-3125"],"ecosystem":"npm","epss":0.00967,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-rvpw-p7vw-wj3m","id":"tcs_01M5KGA0RG6Z968BPEXYJNPPA7","modified_at":"2026-03-16T03:05:28.307271Z","published_at":"2025-06-16T19:37:16Z","references":["https://osv.dev/vulnerability/GHSA-rvpw-p7vw-wj3m","https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-rvpw-p7vw-wj3m","https://nvd.nist.gov/vuln/detail/CVE-2025-6087","https://github.com/cloudflare/workers-sdk/pull/9608","https://github.com/opennextjs/opennextjs-cloudflare/pull/727","https://github.com/opennextjs/opennextjs-cloudflare/commit/36119c0f490c95b3d4f6e826d745b728c80625ab","https://github.com/opennextjs/opennextjs-cloudflare"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-rvpw-p7vw-wj3m","url":"https://osv.dev/vulnerability/GHSA-rvpw-p7vw-wj3m"}],"summary":"OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint"}