CVE-2026-100409

What it actually does

The flaw causes inconsistent pathname handling between middleware authorization checks and cache key lookup when enableCacheInterception is active, allowing percent-encoded or malformed paths to bypass middleware while matching protected cached routes after decoding.

Why it matters to the business

Unauthorized parties can retrieve cached content from protected routes, leading to exposure of sensitive or access-controlled data without authentication.

How an attack unfolds

An attacker identifies routes protected by middleware but served from cache, then submits requests using percent-encoded pathnames that fail to match middleware rules yet decode to the exact cache key of the protected content, returning the cached response directly.

How to fix it

Upgrade OpenNext Cloudflare to version 1.20.2 or later, which enforces consistent pathname processing between middleware and cache operations.

How to confirm the fix worked

Confirm the deployed version is 1.20.2 or newer; test protected routes by sending both encoded and decoded path variants to verify middleware authorization is enforced before cache responses are returned.

Typical attack path

1. Map application routes protected by middleware with cache interception enabled
2. Craft percent-encoded or partially malformed pathnames that evade middleware evaluation
3. Submit requests to trigger cache lookup and retrieve protected content without authorization

How to detect it

Review web server and application logs for requests containing percent-encoded path segments targeting cached routes; correlate entries showing cache hits on protected content without prior middleware authorization events.

What your security team should do

• Upgrade to 1.20.2 immediately due to the 16-day publication window
• Disable enableCacheInterception or review middleware rules for any protected cached routes until patched
• Audit all middleware-protected routes for encoding consistency in access control logic