CVE-2026-100409: 
JavaScript vulnerability analysis and mitigation

CVE-2026-100409 is an authorization bypass vulnerability in the OpenNext Cloudflare adapter (@opennextjs/cloudflare) caused by inconsistent handling of percent-encoded URL paths between middleware matching and cache lookup. When enableCacheInterception is enabled, an unauthenticated attacker can craft encoded pathnames that evade authorization middleware but resolve to the cache key of a protected route, causing protected cached content to be returned without authentication. Affected versions span from 0.3.0 up to (but not including) 1.20.2. The vulnerability was disclosed on July 21, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-177 (Improper Handling of URL Encoding) and CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). Middleware matching previously used the raw encoded request pathname, while cache interception decoded the pathname before performing cache key lookup — creating a validation/canonicalization ordering flaw. For example, a request to GET /%61dmin would not match a middleware matcher for /admin/:path* (because the encoded form differs), but cache interception would decode %61dmin to admin and return the cached /admin response. Additionally, malformed encodings (e.g., /%61dmin/%ZZ) were partially decoded per path segment, allowing cache lookup to proceed with a pathname that middleware never consistently evaluated. The fix, implemented in upstream PRs #1199 and #1200, aligns encoded-path handling across both middleware matching and cache lookup, and rejects malformed paths rather than partially decoding them (GitHub Advisory, Fix PR #1199).

Successful exploitation allows an unauthenticated remote attacker to retrieve cached content from routes intended to be protected by middleware-based access control. The confidentiality impact is high — sensitive or protected page content can be exposed without any credentials — while integrity and availability are unaffected. The vulnerability only affects applications that explicitly enable enableCacheInterception, rely on middleware for access control, and have matching cached protected routes; applications not meeting all three conditions are not at risk (GitHub Advisory, Feedly).

The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity, making it automatable at scale (confirmed by NVD SSVC assessment). As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. No threat actor attribution has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Identify target: Locate a Next.js application deployed on Cloudflare Workers using @opennextjs/cloudflare versions 0.3.0–1.20.1 with enableCacheInterception: true and middleware-based access control on one or more routes (e.g., /admin).
2. Identify protected cached routes: Browse or enumerate the application to identify routes that are statically generated and cached (e.g., /admin), which are protected by middleware returning 401 or redirecting unauthenticated users.
3. Craft percent-encoded request: Encode one or more characters in the protected pathname so the encoded form does not match the middleware matcher pattern. For example, encode a as %61 to produce /%61dmin for a route protected at /admin/:path*.
4. Send encoded request: Issue an HTTP GET request with the encoded pathname: GET /%61dmin HTTP/1.1. The middleware matcher evaluates the raw encoded path /%61dmin, which does not match /admin/:path*, so authorization middleware is skipped.
5. Cache interception decodes and serves: The cache interception layer decodes %61dmin to admin, matches the cache key for /admin, and returns the cached protected response with x-opennext-cache: HIT and HTTP 200.
6. (Optional) Malformed encoding bypass: For additional path segments, use malformed percent-encoding (e.g., /%61dmin/%ZZ) to exploit partial decoding, allowing cache lookup to proceed with a partially decoded pathname that middleware did not evaluate (GitHub Advisory, Fix PR #1199).

• Network: HTTP GET requests to protected routes using percent-encoded path characters that decode to known protected paths (e.g., /%61dmin, /%70rotected); requests containing malformed percent-encoding sequences (e.g., /%ZZ, /%GG) in URL paths targeting cached routes.
• Logs: Cloudflare Worker access logs showing requests with encoded pathnames returning HTTP 200 with x-opennext-cache: HIT for routes that should require authentication; absence of middleware 401/redirect responses for requests to protected route equivalents.
• Response Headers: Presence of x-opennext-cache: HIT on responses to encoded-path requests for routes that should be access-controlled (GitHub Advisory).

The primary remediation is to upgrade @opennextjs/cloudflare to version 1.20.2 or later, which aligns encoded-path handling across middleware matching and cache lookup and rejects malformed paths (Release 1.20.2). If immediate upgrade is not possible, the following workarounds reduce exposure:

• Disable cache interception: Remove enableCacheInterception: true from the defineCloudflareConfig configuration.
• Enforce authorization in route handlers: Add authentication checks inside protected route handlers rather than relying solely on middleware.
• Reject encoded paths at a trusted proxy: Configure an upstream proxy or WAF to reject or normalize percent-encoded paths before they reach the Cloudflare Worker.

Note: Adding individual encoded variants to middleware matchers is not a complete workaround, as pathnames can have multiple equivalent encodings (GitHub Advisory).

The vulnerability was reported and fixed by james-elicx (a collaborator on the OpenNext project), with the advisory published on July 21, 2026. Early community discussion was observed on Infosec.exchange (Mastodon) shortly after disclosure. Coverage appeared on automated vulnerability tracking platforms including VulDB, CVEFeed, and Radar by Offseq. No major vendor statements beyond the GitHub Security Advisory or notable independent researcher commentary have been identified at this time (GitHub Advisory).