{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-100409",
        "tracking": {
            "current_release_date": "2026-10-20T07:56:36.403370Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-100409",
            "initial_release_date": "2026-10-15T17:36:50.104927Z",
            "revision_history": [
                {
                    "date": "2026-10-15T17:36:50.104927Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-10-15T17:37:00.435774Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-10-15T20:40:10.926925Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (7).| CWES updated (1)."
                },
                {
                    "date": "2026-10-15T20:40:15.278555Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-10-19T12:20:13.988741Z",
                    "number": "5",
                    "summary": "CVSS created.| CWES created (2).| References created (7).| Description created for source.| Unknown change."
                },
                {
                    "date": "2026-10-20T02:34:23.974401Z",
                    "number": "6",
                    "summary": "CVSS created.| CWES created (2).| Products created (1).| References created (6).| Description created for source.| Unknown change."
                },
                {
                    "date": "2026-10-20T02:34:26.010310Z",
                    "number": "7",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-10-20T06:18:03.162359Z",
                    "number": "8",
                    "summary": "CVSS created.| CWES created (2).| Products created (1).| References created (5).| Description created for source.| Unknown change."
                },
                {
                    "date": "2026-10-20T06:18:03.253643Z",
                    "number": "9",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-10-20T06:18:08.497867Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-10-20T07:30:53.843625Z",
                    "number": "11",
                    "summary": "EPSS created.| Unknown change."
                },
                {
                    "date": "2026-10-20T07:40:15.358373Z",
                    "number": "12",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "12"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0.3.0|<1.20.2",
                                "product": {
                                    "name": "vers:unknown/>=0.3.0|<1.20.2",
                                    "product_id": "CSAFPID-9738605"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "@opennextjs/cloudflare"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0.3.0|<1.20.2",
                                "product": {
                                    "name": "vers:unknown/>=0.3.0|<1.20.2",
                                    "product_id": "CSAFPID-9740727"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "opennextjs-cloudflare"
                    }
                ],
                "category": "vendor",
                "name": "opennextjs"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-100409",
            "cwe": {
                "id": "CWE-177",
                "name": "Improper Handling of URL Encoding (Hex Encoding)"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100409"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nWhen cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.\n\nAn encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.\n\n`enableCacheInterception` is disabled by default.\n\n## Impact\n\nA remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.\n\nAn application is affected when it:\n\n- explicitly enables `enableCacheInterception`;\n- relies on middleware for access control; and\n- has a matching cached route.\n\n## Details\n\nMiddleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.\n\nFor example, consider an application with:\n\n- middleware matcher `/admin/:path*`;\n- middleware returning `401 Authentication required` for `/admin`;\n- a statically generated, cached `/admin` route; and\n- cache interception enabled:\n\n```ts\nexport default defineCloudflareConfig({\n  incrementalCache: staticAssetsIncrementalCache,\n  enableCacheInterception: true,\n});\n```\n\nAn attacker can request:\n\n```http\nGET /%61dmin\n```\n\nThe encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:\n\n```http\nHTTP/1.1 200 OK\nx-opennext-cache: HIT\n\nProtected content\n```\n\nMalformed paths exposed an additional inconsistency. For example:\n\n```http\nGET /%61dmin/%ZZ\n```\n\nThe previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.\n\n## Patches\n\nThe fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).\n\nUsers should upgrade to `@opennextjs/cloudflare@1.20.2` or later.\n\n## Workarounds\n\nIf upgrading is not immediately possible for an application:\n\n1. Disable cache interception by removing `enableCacheInterception: true`.\n2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.\n3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.\n\nAdding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.",
                    "title": "github - https://github.com/advisories/GHSA-2vc4-c4r6-p6v6"
                },
                {
                    "category": "description",
                    "text": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.",
                    "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100409.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nWhen cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.\n\nAn encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.\n\n`enableCacheInterception` is disabled by default.\n\n## Impact\n\nA remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.\n\nAn application is affected when it:\n\n- explicitly enables `enableCacheInterception`;\n- relies on middleware for access control; and\n- has a matching cached route.\n\n## Details\n\nMiddleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.\n\nFor example, consider an application with:\n\n- middleware matcher `/admin/:path*`;\n- middleware returning `401 Authentication required` for `/admin`;\n- a statically generated, cached `/admin` route; and\n- cache interception enabled:\n\n```ts\nexport default defineCloudflareConfig({\n  incrementalCache: staticAssetsIncrementalCache,\n  enableCacheInterception: true,\n});\n```\n\nAn attacker can request:\n\n```http\nGET /%61dmin\n```\n\nThe encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:\n\n```http\nHTTP/1.1 200 OK\nx-opennext-cache: HIT\n\nProtected content\n```\n\nMalformed paths exposed an additional inconsistency. For example:\n\n```http\nGET /%61dmin/%ZZ\n```\n\nThe previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.\n\n## Patches\n\nThe fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).\n\nUsers should upgrade to `@opennextjs/cloudflare@1.20.2` or later.\n\n## Workarounds\n\nIf upgrading is not immediately possible for an application:\n\n1. Disable cache interception by removing `enableCacheInterception: true`.\n2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.\n3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.\n\nAdding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.",
                    "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-2vc4-c4r6-p6v6.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100409"
                },
                {
                    "category": "other",
                    "text": "0.00305",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "4.1",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "Is related to an uncommon cwe id",
                    "title": "NCSC Score top increasing factors"
                },
                {
                    "category": "other",
                    "text": "There is cwe data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-9738605",
                    "CSAFPID-9740727"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - ncscclear",
                    "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100409"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100409"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-2vc4-c4r6-p6v6"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100409.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-2vc4-c4r6-p6v6.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-100409"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/opennextjs/opennextjs-aws/pull/1199"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/opennextjs/opennextjs-aws/pull/1200"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/38ea40b669be272ddf09a7df7e70c69d0b57404b"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/@opennextjs/cloudflare@1.20.2"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100409"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-2vc4-c4r6-p6v6"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv",
                    "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100409.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-9738605",
                        "CSAFPID-9740727"
                    ]
                }
            ],
            "title": "CVE-2026-100409"
        }
    ]
}