CVE-2026-100409

Name of the Vulnerable Software and Affected Versions OpenNext Cloudflare versions 0.3.0 through 1.20.1

Description Applications that enable enableCacheInterception and rely on middleware for access control are subject to inconsistent processing of encoded pathnames between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that bypasses authorization middleware but decodes to the cache key of a protected route, resulting in the unauthorized retrieval of cached content. Additionally, malformed encodings may be partially decoded, allowing the cache lookup to proceed with a pathname that the middleware did not evaluate consistently.

Recommendations Update to version 1.20.2 or later. Disable cache interception by removing enableCacheInterception: true. Enforce authorization inside protected route handlers instead of relying solely on middleware. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.