OpenNextJS Cloudflare Cache Bypass in Middleware Matching Allows Auth Evasion

The OpenNextJS Cloudflare package contains a high-severity cache bypass vulnerability that allows attackers to evade middleware authorization checks. This flaw, identified as CVE-2026-100409, exists in how the software handles percent-encoded URLs when cache interception is active. Applications relying on middleware for access control while using cached routes are exposed to unauthorized data disclosure. The issue stems from inconsistent path decoding logic between the middleware matcher and the cache lookup system.

Root cause

The underlying issue arises because middleware matching and cache interception process URL paths differently. Middleware matching evaluates the request pathname in its original, percent-encoded form. In contrast, the cache interception layer decodes the pathname before selecting a cache entry. This discrepancy means an encoded request can skip middleware validation while still resolving to a valid cached resource. Additionally, malformed path segments were decoded inconsistently, allowing partially decoded paths to proceed to cache lookup.

Attack path

An attacker can exploit this by sending a request with a percent-encoded path that does not match the middleware rule. For example, requesting `/%61dmin` instead of `/admin` bypasses the `/admin/:path*` middleware matcher. The middleware is not invoked, so no authentication check occurs. The cache interception layer then decodes `%61dmin` to `admin` and retrieves the cached response for the protected route. The attacker receives the protected content with a 200 OK status and a cache hit header.

Affected versions

• OpenNextJS Cloudflare npm package versions 0.3.0 and later are vulnerable.
• Versions prior to 1.20.2 are affected by this cache bypass flaw.
• Version 1.20.2 is the first release that patches the vulnerability.
• The default configuration disables cache interception, limiting exposure.

Mitigation

• Update the @opennextjs/cloudflare npm package to version 1.20.2 or later.
• Disable the `enableCacheInterception` option if updating is not immediately possible.
• Avoid relying solely on middleware for access control on cached routes.
• Implement server-side validation for sensitive resources regardless of caching.

Signals worth monitoring

Security teams should monitor web server logs for requests containing high volumes of percent-encoded characters that result in successful cache hits. Look for mismatches between middleware execution logs and cache retrieval events for sensitive endpoints. Alert on 200 OK responses for protected routes when no prior authentication middleware execution is recorded. Check for unusual patterns in URL encoding that deviate from standard user behavior. Verify that cache headers indicate hits for requests that should have been blocked by access controls.

What to do and how to stay safe: OpenNextJS

• Review your OpenNextJS Cloudflare configuration to see if `enableCacheInterception` is enabled.
• Audit your middleware rules to ensure they cover all sensitive routes and path variations.
• Update your npm dependencies to the latest patched version of the Cloudflare package.
• Monitor access logs for encoded paths targeting protected administrative or user-specific routes.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect all OpenNextJS Cloudflare installations?

No, it only affects installations that explicitly enable the `enableCacheInterception` option and rely on middleware for access control on cached routes.

How does the attacker bypass the middleware?

The attacker sends a percent-encoded URL that does not match the middleware pattern, causing the middleware to skip, while the cache system decodes the path and serves the cached content.

Is there a patch available for this vulnerability?

Yes, version 1.20.2 of the @opennextjs/cloudflare package includes a fix that aligns path handling between middleware matching and cache lookup.