CVE-2026-3125 is a Server-Side Request Forgery (SSRF) vulnerability identified in the @opennextjs/cloudflare package, specifically within the /cdn-cgi/image/ handler. The root cause is a path normalization bypass that occurs when an attacker replaces the forward slash (/) with a backslash (\) in the URL path (e.g., /cdn-cgi\image/ instead of /cdn-cgi/image/). Normally, Cloudflare's edge intercepts requests to /cdn-cgi/image/ and prevents them from reaching the Worker in production environments. However, the backslash substitution bypasses this interception because some HTTP clients preserve backslashes in the path, allowing the request to reach the Worker directly. Once the Worker receives the request, the JavaScript URL class normalizes the backslash back to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs controlled by the attacker. This enables SSRF attacks where attacker-controlled content is served through the victim's domain, violating the same-origin policy and potentially misleading users or other services relying on domain-based trust. Furthermore, a similar bypass affects Cloudflare Workers with Assets and Cloudflare Pages, where assets stored under /cdn-cgi/ paths are normally inaccessible publicly. Using the backslash bypass, these assets, including sensitive incremental cache data stored under /cdn-cgi/_next_cache, can be accessed publicly, risking exposure of private data. The vulnerability requires no authentication or user interaction but depends on the HTTP client preserving backslashes in the URL path, limiting exploitation vectors primarily to tools like curl with --path-as-is. No patches or exploits in the wild are currently reported, but the vulnerability is rated high severity with a CVSS 4.0 score of 7.7 due to its potential impact on confidentiality and integrity.

This vulnerability poses significant risks to organizations using the @opennextjs/cloudflare package, Cloudflare Workers with Assets, or Cloudflare Pages. The SSRF flaw allows attackers to make the vulnerable server fetch arbitrary remote URLs, potentially leading to unauthorized data access, information disclosure, or use of the victim domain to serve malicious content, undermining user trust and violating same-origin policy protections. The exposure of private assets stored under /cdn-cgi/ paths can lead to leakage of sensitive incremental cache data or other confidential files, which may contain proprietary or user data. This can facilitate further attacks such as credential theft, data exfiltration, or phishing by serving attacker-controlled content from trusted domains. The vulnerability requires no authentication or user interaction, increasing the risk of automated exploitation by attackers with network access to the vulnerable endpoints. Although exploitation is limited to HTTP clients that preserve backslashes, this includes common command-line tools used in penetration testing and automated attack frameworks. The widespread use of Cloudflare services and the @opennextjs/cloudflare package in modern web applications means that many organizations globally could be affected, especially those relying on Cloudflare Workers and Pages for content delivery and caching. The impact extends to confidentiality and integrity of data and services, with moderate impact on availability since the vulnerability does not directly cause denial of service.

Organizations should immediately audit their use of the @opennextjs/cloudflare package and Cloudflare Workers or Pages that utilize /cdn-cgi/image/ or /cdn-cgi/ asset paths. Specific mitigations include: 1) Implement strict input validation and normalization on URL paths to reject or correctly handle backslash characters before processing requests, preventing path normalization bypass. 2) Configure Cloudflare edge rules or firewall policies to detect and block requests containing backslashes in URL paths, especially those targeting /cdn-cgi/ endpoints. 3) Avoid using the vulnerable /cdn-cgi/image/ handler in production environments or replace it with a hardened alternative that does not rely on path matching vulnerable to backslash bypass. 4) Restrict access to sensitive assets and cache directories by enforcing authentication or token-based access controls rather than relying solely on obscurity or path restrictions. 5) Monitor logs for suspicious requests containing backslashes or unusual access patterns to /cdn-cgi/ paths. 6) Stay updated with vendor patches or security advisories from opennextjs and Cloudflare and apply fixes promptly once available. 7) Educate developers and DevOps teams about the risks of path normalization issues and SSRF to prevent similar vulnerabilities in custom code. These targeted actions go beyond generic SSRF mitigations by addressing the unique path normalization bypass vector and Cloudflare-specific behaviors.