High · published June 16, 2025
🚨 An unauthenticated request can lead to arbitrary remote content being served through your domain! This SSRF vulnerability in the @opennextjs/cloudflare package could let attackers proxy malicious content, potentially misdirecting users. 🔥 Think of this as a restaurant that allows patrons to order anything via its delivery menu, including dishes from sketchy food trucks down the street — one wrong order could leave customers with something very unappetizing. 🍽️ An attacker could leverage this flaw to load any remote resource from their server, undermining the security of your site and leading to phishing attempts or data leaks. This could not only harm your reputation but also expose sensitive internal services due to reckless domain abuse. Yikes! ⚠️
Think of this as a restaurant that allows patrons to order anything via its delivery menu, including dishes from sketchy food trucks down the street — one wrong order could leave customers with something very unappetizing. 🍽️ The SSRF vulnerability arises from the unimplemented feature in the Cloudflare adapter for Open Next, allowing unauthenticated users to proxy requests through the /_next/image endpoint, bypassing the same-origin policy.
An attacker could leverage this flaw to load any remote resource from their server, undermining the security of your site and leading to phishing attempts or data leaks. This could not only harm your reputation but also expose sensitive internal services due to reckless domain abuse. Yikes! ⚠️ To safeguard your site, update to @opennextjs/cloudflare version 1.3.0 as soon as possible. Ensure you implement the remotePatterns filter in your Next config if you must allow specific external images. Don't forget to check the package dependency for create-cloudflare and upgrade to version 2.49.3 as well! 🛡️ You've got this! By taking these steps, you'll tighten your security and protect your users from potential threats. 🚀