[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opennextjs/cloudflare (source)	1.17.1 → 1.20.2

---

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

CVE-2026-100409 / GHSA-2vc4-c4r6-p6v6

More information

Details

Summary

When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup.

An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.

enableCacheInterception is disabled by default.

Impact

A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.

An application is affected when it:

• explicitly enables enableCacheInterception;
• relies on middleware for access control; and
• has a matching cached route.

Details

Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.

For example, consider an application with:

• middleware matcher /admin/:path*;
• middleware returning 401 Authentication required for /admin;
• a statically generated, cached /admin route; and
• cache interception enabled:

export default defineCloudflareConfig({
  incrementalCache: staticAssetsIncrementalCache,
  enableCacheInterception: true,
});

An attacker can request:

GET /%61dmin

The encoded pathname does not match /admin/:path*, so the authorization middleware is not invoked. Cache interception then decodes %61dmin to admin and may return the cached /admin response:

HTTP/1.1 200 OK
x-opennext-cache: HIT

Protected content

Malformed paths exposed an additional inconsistency. For example:

GET /%61dmin/%ZZ

The previous implementation decoded each segment independently. It decoded %61dmin to admin but retained the malformed %ZZ segment, allowing cache lookup to continue using a partially decoded pathname.

Patches

The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in opennextjs-aws#1199 and opennextjs-aws#1200.

Users should upgrade to @opennextjs/cloudflare@1.20.2 or later.

Workarounds

If upgrading is not immediately possible for an application:

1. Disable cache interception by removing enableCacheInterception: true.
2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.
3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.

Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6
• https://nvd.nist.gov/vuln/detail/CVE-2026-100409
• https://github.com/opennextjs/opennextjs-aws/pull/1199
• https://github.com/opennextjs/opennextjs-aws/pull/1200
• https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b
• https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2
• https://github.com/advisories/GHSA-2vc4-c4r6-p6v6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.20.2

Compare Source

Patch Changes

• #​1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

  Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

• #​1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

• #​1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

  Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

v1.20.1

Compare Source

Patch Changes

• #​1460 8e60ded Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.12

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.12

  • Fix Next.js 15 builds failing with "Next.js version 15.x.x is not supported by the Next.js team" now that Next.js 15 is 2 years old. A major version stays supported until the second next major (Next.js 17) is released.

• #​1414 15f4c9e Thanks @​allangreatsoftwares! - fix: render server action redirects for the host of the request

• #​1439 1ebbc55 Thanks @​mathurshubham! - fix: inline named webpack chunks (webpackChunkName) in the server runtime

  Apps built with webpack returned a 500 with Error: Unknown chunk N when the server code loaded a chunk named with /* webpackChunkName: "..." */, i.e. from a next/dynamic or import() in the app or in a dependency. Named chunks are now bundled into the Worker and load correctly.

v1.20.0

Compare Source

Minor Changes

• #​1290 46c50fc Thanks @​james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

  Key Changes:

  1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.

     • R2_ACCESS_KEY_ID
     • R2_SECRET_ACCESS_KEY
     • CF_ACCOUNT_ID

  2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.

  3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.

  Usage:

  Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:

  pnpm add rclone.js
  pnpm approve-builds # select rclone.js
  pnpm rebuild rclone.js
  R2_ACCESS_KEY_ID=your_key
  R2_SECRET_ACCESS_KEY=your_secret
  CF_ACCOUNT_ID=your_account
  
  opennextjs-cloudflare deploy --rclone

  You can also set the environment variables for CI builds.

  Notes:

  • You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.
  • rclone may not be supported on all platforms.

Patch Changes

• #​1289 eef243f Thanks @​thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges run

  BucketCachePurge.alarm() passed its tag bindings to SqlStorage.exec as a
  single array. exec(query, ...bindings) is variadic over its bindings, so for a
  multi-tag DELETE ... WHERE tag IN (?, ?, …) the binding count (1) disagreed
  with the placeholder count (N) and exec threw "Wrong number of parameter
  bindings" on every flush. On-demand revalidateTag purges therefore never
  reached the Cloudflare cache, and with bypassTagCacheOnCacheHit enabled pages
  served stale until the ISR TTL expired.

  Spread the bindings, normalise the INSERT to the same variadic form, and
  tighten the drain loop's guard from while (tags.length >= 0) (which never
  exits via the condition) to while (tags.length > 0).

• #​1291 51439b1 Thanks @​james-elicx! - fix: disable response compression when provisioning R2 cache buckets

  Avoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.

v1.19.11

Compare Source

Patch Changes

• #​1270 802047e Thanks @​alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping

  Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.

  Closes #​1230

v1.19.10

Compare Source

Patch Changes

• #​1261 780dd4f Thanks @​vicb! - Allow populating R2 when the domain is protected by Cloudflare Access

  You need to:

  • create a "Service Auth" policy for "open-next-cache-populate..workers.dev"
  • add an "Include" rule for "Any Access Service Token" or for a given service token ("Service Token")
  • populate the env variables CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET

v1.19.9

Compare Source

Patch Changes

• #​1259 3b35c6e Thanks @​vicb! - chore: bump Next.js to 15.5.18 / 16.2.6 and @​opennextjs/aws to 4.0.2

v1.19.8

Compare Source

Patch Changes

• #​1256 9696cd0 Thanks @​vicb! - bump @opennextjs/aws to 4.0.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.0.1

v1.19.7

Compare Source

Patch Changes

• #​1252 29fe15d Thanks @​vicb! - bump the number of retries for r2 cache uploads

  Increase the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.

• #​1255 364b7d9 Thanks @​vicb! - Bump react and next

v1.19.6

Compare Source

Patch Changes

• #​1246 5d2014f Thanks @​vicb! - fix: do not log expected expected D1 errors

  The populateCache command adds columns to the D1 tag cache for SWR support.
  This is required for older deployments made before those column were added.
  SQLite errors when the columns exist and we should not log those errors.

• #​1244 01babce Thanks @​tahmid-23! - fix: drop streaming wasm calls in Turbopack runtime

  Turbopack replaces wasm imports using WebAssembly.compileStreaming and
  WebAssembly.instantiateStreaming. These functions are not available in
  the workerd runtime.

  We add a helper loadWasmChunkFn. This is a generated switch statement
  that contains an import for each wasm chunk. We use static strings for
  all imports to ensure that all necessary wasm chunks will be detected
  and bundled for the final build.

  The Turbopack patcher replaces the invocations in loadWebAssembly and
  loadWebAssemblyModule, using the synchronous WebAssembly.instantiate
  and redirecting to loadWasmChunkFn.

• #​1243 1c815de Thanks @​tahmid-23! - fix: detect object-valued conditions

  The pre-existing build condition transform logic had subtle errors:

  • failed to recognize object conditions
    (e.g. "workerd": { "import": ..., "require": ... })
  • sibling pruning only applied to strings, not objects

  Now, we fully support object conditions. Furthermore, we prune siblings,
  unless its subtree also contains the build condition.

v1.19.5

Compare Source

Patch Changes

• #​1240 dd7de1d Thanks @​vicb! - fix: add missing git ignored files for the migrate command

v1.19.4

Compare Source

Patch Changes

• #​1221 a2679bf Thanks @​mushan0x0! - Stop bundling @vercel/og (and its ~1.4 MiB resvg.wasm) when the app does not use it.

  Next.js's externalImport helper keeps a dynamic import("next/dist/compiled/@vercel/og/index.edge.js") in the emitted handler even for apps that never use ImageResponse / opengraph-image. Previously this module was marked as external when useOg was false, which left Wrangler to resolve and bundle it — pulling in ~800 KiB of JS plus resvg.wasm and pushing many Workers over the Cloudflare free-tier 3 MiB gzip limit.

  When useOg is false, the edge entry is now aliased to the existing throw.js shim, so the unreachable dynamic import resolves to a tiny module and the real @vercel/og library is no longer pulled into the Worker bundle.

• #​1208 2c5b472 Thanks @​edmundhung! - Use OPEN_NEXT_BUILD_ID instead of NEXT_BUILD_ID in the cache keys.

  As of Next 16.2 NEXT_BUILD_ID is a fixed value when deploymentId is set explicitly.

  See opennextjs/opennextjs-aws#1144

• #​1193 1e8d232 Thanks @​conico974! - Fix tag cache stale logic

v1.19.3

Compare Source

Patch Changes

• #​1215 608893e Thanks @​vicb! - Factor large repeated values in manifests

  This reduce the size of the generated code.

• #​1218 f0d0226 Thanks @​314systems! - remove process.version override

  Remove process.version / process.versions.node overrides now that unjs/unenv#493 is merged and shipped in unenv@2.0.0-rc.16 (project uses 2.0.0-rc.24)

• #​1199 32594d6 Thanks @​SdSadat! - fix(cli): fail fast in non-TTY environments instead of hanging on config-creation prompts

  When open-next.config.ts (or wrangler.(toml|json|jsonc)) is missing, the CLI
  prompts the user to auto-create it. In non-TTY environments (Cloudflare Workers
  Builds, Docker, CI) the Enquirer prompt can't read stdin, so the build hangs or
  fails with a truncated prompt and a cryptic exit code — the user sees
  ? Missing required open-next.config.ts file, do you want to create one? (Y/n)
  and then ELIFECYCLE Command failed with exit code 13, with no hint at what
  to do next.

  Now, in non-interactive environments, both prompts throw an actionable error
  with the exact template to paste (for open-next.config.ts) or point at the
  existing --skipWranglerConfigCheck / SKIP_WRANGLER_CONFIG_CHECK escape
  hatch (for the wrangler config). Interactive behavior is unchanged.

v1.19.2

Compare Source

Patch Changes

• #​1207 0958726 Thanks @​edmundhung! - bump @opennextjs/aws to 3.10.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.10.2

• #​1139 79b01b8 Thanks @​james-elicx! - Fix Turbopack external module resolution by dynamically discovering external imports at build time.

  When packages are listed in serverExternalPackages, Turbopack externalizes them via externalImport() which uses dynamic await import(id). The bundler (ESBuild) can't statically analyze import(id) with a variable, so these modules aren't included in the worker bundle.

  This patch:

  • Discovers hashed Turbopack external module mappings from .next/node_modules/ symlinks (e.g. shiki-43d062b67f27bbdc → shiki)
  • Scans traced chunk files for bare external imports (e.g. externalImport("shiki")) and subpath imports (e.g. shiki/engine/javascript)
  • Generates explicit switch/case entries so the bundler can statically resolve and include these modules

• #​1203 6f02d12 Thanks @​314systems! - fix: exclude unsupported Next.js 16 releases from peer dependencies.

  The previous range allowed Next.js 16.0.0 through 16.2.2 without a peer dependency warning because >=16.2.3 was already covered by >=15.5.15.

  The range now explicitly supports Next.js 15.5.15 and above in the 15.x line, and Next.js 16.2.3 and above in the 16.x line.

• #​1200 7820ad0 Thanks @​NathanDrake2406! - fix: reuse sharded tag data when filling the regional cache.

  The sharded tag cache miss path already reads tag data from the Durable Object before answering the request. Reuse that fetched data when populating the regional cache so a shard miss does not immediately trigger a second identical Durable Object read.

• #​1206 585795d Thanks @​314systems! - fix: regression where getEnvFromPlatformProxy received wrong options type

  This fixes a regression introduced in 32ba91a where getEnvFromPlatformProxy call sites passed OpenNextConfig even though the function expects Wrangler GetPlatformProxyOptions.

  The fix restores the pre-32ba91a argument shape by passing { configPath, environment } from CLI arguments, so env resolution follows the selected Wrangler config/environment.

v1.19.1

Compare Source

Patch Changes

• #​1270 802047e Thanks @​alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping

  Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.

  Closes #​1230

v1.19.0

Compare Source

Minor Changes

• #​1168 9a26846 Thanks @​conico974! - Add support for SWR (stale-while-revalidate) in revalidateTag

  See the AWS implementation for more details.

Patch Changes

• #​1184 c7d6425 Thanks @​vicb! - fix for Next.js CVE-2026-23869

  See the CVE-2026-23869 summary for details.

  This CVE is fixed by bumping the minium Next.js release version to 15.5.15/16.2.3

• #​1177 e814a63 Thanks @​conico974! - Fix use cache not working as expected in Next 16+

v1.18.1

Compare Source

Patch Changes

• #​1176 2232651 Thanks @​conico974! - fix for OG with Next 16.2.2

• #​1166 f89fba1 Thanks @​ash1day! - fix: sort .endsWith() checks by path length descending to prevent suffix collisions in dynamic requires

  Routes whose paths are suffixes of other routes (e.g. /test/app vs /) were resolved incorrectly because the shorter path matched first in the generated .endsWith() chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.

  Fixes #​1156.

v1.18.0

Compare Source

Minor Changes

• #​1159 75f5f0a Thanks @​edmundhung! - Use remote dev for R2 cache population

  Using remote dev is not subject to the Cloudflare API rate limit of 1,200 requests per 5 minutes that caused failures for large applications with thousands of prerendered pages.

v1.17.3

Compare Source

Patch Changes

• #​1160 161e726 Thanks @​matthewvolk! - fix(patches): include prefetch-hints.json in loadManifest build-time inlining

  Next.js 16.2.0 introduced prefetch-hints.json as a new server manifest loaded unconditionally
  by NextNodeServer.getPrefetchHints(). The file exists in the build output but wasn't matched by
  the glob pattern *-manifest.json, causing the patched loadManifest() to throw at runtime.

v1.17.2

Compare Source

Patch Changes

• #​1151 a143282 Thanks @​nathanschram! - fix: handle known optional manifests gracefully in loadManifest/evalManifest patches

  Next.js loads certain manifests with handleMissing: true (returning {} when the file doesn't
  exist). The adapter's build-time glob scan doesn't find these files when they're conditionally
  generated, so the patched function threw at runtime, crashing dynamic routes with 500.

  Instead of a blanket catch-all, handle only the specific optional manifests from Next.js
  route-module.ts:

  • react-loadable-manifest (Turbopack per-route, not all routes have dynamic imports)
  • subresource-integrity-manifest (only when experimental.sri configured)
  • server-reference-manifest (App Router only)
  • dynamic-css-manifest (Pages Router + Webpack only)
  • fallback-build-manifest (only for /_error page)
  • prefetch-hints (new in Next.js 16.2)
  • _client-reference-manifest.js (optional for static metadata routes, evalManifest)

  Manifest matching strips .json before comparison since some Next.js constants omit
  the extension (SUBRESOURCE_INTEGRITY_MANIFEST, DYNAMIC_CSS_MANIFEST, etc.).

  Unknown manifests still throw to surface genuine errors.

  Fixes #​1141.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: logchimp/docs/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31e3c034-9a29-4df5-a5b4-663cbd200299

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings: 1

Validation error: Unrecognized key: "path_filters"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}