An encoded URL could skip Next.js middleware and get a protected page from the OpenNext Cloudflare cache
On October 15, 2026, CVE-2026-100409 was published for @opennextjs/cloudflare 0.3.0 before 1.20.2. If an app turned on enableCacheInterception and protected routes only with middleware, a percent-encoded URL could skip the middleware and still get the cached protected page. The record rates it High, CVSS 3.1 score 7.5. It is patched in 1.20.2 (advisory published July 21, 2026).
What was reported
CVE-2026-100409 was published October 15, 2026. The NVD record says @opennextjs/cloudflare from 0.3.0 until 1.20.2 can handle encoded pathnames differently in middleware matching and in cache lookup. An app is in that situation when it turns on enableCacheInterception, relies on middleware for access control, and has a matching cached protected route. An unauthenticated attacker can request a percent-encoded pathname that does not match the authorization middleware but decodes to the cache key of a protected route, so the cached page is returned without authorization. Malformed encodings can also be partly decoded. The record says this is fixed in 1.20.2. The affected range is >= 0.3.0, < 1.20.2. It assigns CWE-177 and CWE-180, and CVSS 3.1 score 7.5, severity High, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. CISA's SSVC entry, dated October 15, 2026, says exploitation none, automatable yes, and technical impact partial.
It only applies with enableCacheInterception, which is off by default, and it is patched in 1.20.2 (advisory published July 21, 2026). GHSA-2vc4-c4r6-p6v6, published July 21, 2026, says enableCacheInterception is disabled by default and names 1.20.2 as the patched version. Its example is GET /%61dmin against a /admin/:path* matcher: the encoded path does not match, so the auth middleware does not run, and cache interception then decodes the path to admin and may return the cached /admin page. A malformed path such as /%61dmin/%ZZ could be partly decoded. The advisory says removing enableCacheInterception: true, enforcing authorization inside protected route handlers, or rejecting encoded paths at a trusted proxy are workarounds, and that adding encoded matcher variants is not a complete fix.
How to prevent it
Check authorization inside each protected route handler, not only in Next.js middleware, and upgrade @opennextjs/cloudflare to 1.20.2 or later if you enabled enableCacheInterception. The advisory says that option is off by default, and that adding encoded matcher variants is not a complete fix.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.