CVE-2026-3125

OpenNext Cloudflare Adapter Flaw Enables Server-Side Request Forgery and Private Cache Disclosure CVE-2026-3125

Cloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.