cvelistv5 - cve-2025-6087

CVE-2025-6087 (GCVE-0-2025-6087)

Vulnerability from cvelistv5 – Published: 2025-06-16 18:30 – Updated: 2025-06-16 18:55

Summary

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services. Impact: * SSRF via unrestricted remote URL loading * Arbitrary remote content loading * Potential internal service exposure or phishing risks through domain abuse Mitigation: The following mitigations have been put in place: * Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next * Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets.

Severity ?

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

cloudflare

References

URL

Tags

https://github.com/opennextjs/opennextjs-cloudflare

Impacted products

	Vendor	Product	Version
			Affected: 0 , < 1.3.0 (git)

Credits

Edward Coristine

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-16T18:55:28.409358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T18:55:53.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/opennextjs",
          "defaultStatus": "unaffected",
          "packageName": "opennextjs-cloudflare",
          "repo": "https://github.com/opennextjs/opennextjs-cloudflare",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Edward Coristine"
        }
      ],
      "datePublic": "2025-06-15T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eA Server-Side Request Forgery (SSRF) vulnerability was identified in the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e@opennextjs/cloudflare\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e/_next/image\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e endpoint.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eFor example:\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003ci\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://victim-site.com/_next/image?url=https://attacker.com\"\u003ehttps://victim-site.com/_next/image?url=https://attacker.com\u003c/a\u003e\u003c/i\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\u003c/span\u003e\u003c/p\u003e\u003cb\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eImpact:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eSSRF via unrestricted remote URL loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eArbitrary remote content loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003ePotential internal service exposure or phishing risks through domain abuse\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cb\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eMitigation:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThe following mitigations have been put in place:\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eServer side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e/_next/image\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003eendpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/opennextjs/opennextjs-cloudflare/pull/727\"\u003e\u003cspan style=\"background-color: transparent;\"\u003eRoot cause fix\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\"background-color: transparent;\"\u003eto the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0\"\u003e\u003cspan style=\"background-color: transparent;\"\u003e@opennextjs/cloudflare@1.3.0\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/cloudflare/workers-sdk/pull/9608\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ePackage dependency update\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\"background-color: transparent;\"\u003eto create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.npmjs.com/package/create-cloudflare/v/2.49.3\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ecreate-cloudflare@2.49.3\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\"background-color: transparent;\"\u003eIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\"\u003e\u003cspan style=\"background-color: transparent;\"\u003eremotePatterns \u003c/span\u003e\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\"\u003e\u003cspan style=\"background-color: transparent;\"\u003efilter in Next config\u003c/span\u003e\u003c/a\u003e\u003cspan style=\"background-color: transparent;\"\u003e if they need to allow-list external urls with images assets.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n  *  SSRF via unrestricted remote URL loading\n\n\n\n\n  *  Arbitrary remote content loading\n\n\n\n\n  *  Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n  *  Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-16T18:30:44.180Z",
        "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
        "shortName": "cloudflare"
      },
      "references": [
        {
          "url": "https://github.com/opennextjs/opennextjs-cloudflare"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
    "assignerShortName": "cloudflare",
    "cveId": "CVE-2025-6087",
    "datePublished": "2025-06-16T18:30:44.180Z",
    "dateReserved": "2025-06-14T02:12:00.423Z",
    "dateUpdated": "2025-06-16T18:55:53.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-6087\",\"sourceIdentifier\":\"cna@cloudflare.com\",\"published\":\"2025-06-16T19:15:33.837\",\"lastModified\":\"2025-08-06T17:21:28.460\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\\n\\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\\n\\n\\n\\n\\nFor example:\\n\\n https://victim-site.com/_next/image?url=https://attacker.com \\n\\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\\n\\n\\n\\n\\nImpact:\\n\\n  *  SSRF via unrestricted remote URL loading\\n\\n\\n\\n\\n  *  Arbitrary remote content loading\\n\\n\\n\\n\\n  *  Potential internal service exposure or phishing risks through domain abuse\\n\\n\\n\\n\\n\\n\\n\\nMitigation:\\n\\nThe following mitigations have been put in place:\\n\\n  *  Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\\n\\n\\n\\n\\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \\n\\n\\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \\n\\n\\n\\n\\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets.\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad de Server-Side Request Forgery (SSRF) en el paquete @opennextjs/cloudflare. Esta vulnerabilidad se debe a una funci\u00f3n no implementada en el adaptador de Cloudflare para Open Next, que permit\u00eda a usuarios no autenticados acceder a contenido remoto arbitrario mediante el endpoint /_next/image. Este problema permit\u00eda a los atacantes cargar recursos remotos desde hosts arbitrarios bajo el dominio del sitio web v\u00edctima para cualquier sitio implementado con el adaptador de Cloudflare para Open Next. Por ejemplo: https://victim-site.com/_next/image?url=https://attacker.com. En este ejemplo, el contenido controlado por el atacante desde attacker.com se distribuye a trav\u00e9s del dominio del sitio web v\u00edctima (victim-site.com), lo que infringe la pol\u00edtica de mismo origen y podr\u00eda inducir a error a usuarios u otros servicios. Impacto: * SSRF mediante carga remota de URL sin restricciones * Carga remota arbitraria de contenido * Posible exposici\u00f3n interna del servicio o riesgos de phishing por abuso de dominio. Mitigaci\u00f3n: Se han implementado las siguientes mitigaciones: * Actualizaciones del servidor en la plataforma de Cloudflare para restringir el contenido cargado a trav\u00e9s del endpoint /_next/image a im\u00e1genes. La actualizaci\u00f3n mitiga autom\u00e1ticamente el problema en todos los sitios existentes y futuros implementados en Cloudflare que utilicen la versi\u00f3n afectada del adaptador de Cloudflare para Open Next. * Correcci\u00f3n de la causa ra\u00edz (https://github.com/opennextjs/opennextjs-cloudflare/pull/727) en el adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada del adaptador se encuentra aqu\u00ed @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Actualizaci\u00f3n de la dependencia del paquete https://github.com/cloudflare/workers-sdk/pull/9608 para create-cloudflare (c3) para usar la versi\u00f3n corregida del adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada de create-cloudflare se encuentra aqu\u00ed: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 Adem\u00e1s de la mitigaci\u00f3n autom\u00e1tica implementada en la plataforma de Cloudflare, recomendamos a los usuarios afectados que actualicen a @opennext/cloudflare v1.3.0 y utilicen el filtro remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns en la configuraci\u00f3n de Next https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns si necesitan incluir en la lista de permitidos URL externas con recursos de im\u00e1genes.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@cloudflare.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"cna@cloudflare.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cloudflare:create-cloudflare:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"2.49.3\",\"matchCriteriaId\":\"75F34FC9-679E-4655-B803-E84B045271CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opennextjs:opennext_for_cloudflare:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"0EDFEC99-0FB1-4E53-9FC6-DDD1C68AA214\"}]}]}],\"references\":[{\"url\":\"https://github.com/opennextjs/opennextjs-cloudflare\",\"source\":\"cna@cloudflare.com\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-6087\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-16T18:55:28.409358Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-16T18:55:36.815Z\"}}], \"cna\": {\"title\": \"SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Edward Coristine\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.8, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/opennextjs/opennextjs-cloudflare\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.3.0\", \"versionType\": \"git\"}], \"packageName\": \"opennextjs-cloudflare\", \"collectionURL\": \"https://github.com/opennextjs\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-06-15T06:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/opennextjs/opennextjs-cloudflare\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\\n\\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\\u00a0\\n\\n\\n\\n\\nFor example:\\n\\n https://victim-site.com/_next/image?url=https://attacker.com \\n\\nIn this example, attacker-controlled content from attacker.com is served through the victim site\\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\\n\\n\\n\\n\\nImpact:\\n\\n  *  SSRF via unrestricted remote URL loading\\n\\n\\n\\n\\n  *  Arbitrary remote content loading\\n\\n\\n\\n\\n  *  Potential internal service exposure or phishing risks through domain abuse\\n\\n\\n\\n\\n\\n\\n\\nMitigation:\\n\\nThe following mitigations have been put in place:\\n\\n  *  Server side updates to Cloudflare\\u2019s platform to restrict the content loaded via the\\u00a0/_next/image\\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\\n\\n\\n\\n\\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \\u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \\n\\n\\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \\u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \\n\\n\\n\\n\\nIn addition to the automatic mitigation deployed on Cloudflare\\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eA Server-Side Request Forgery (SSRF) vulnerability was identified in the \u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e@opennextjs/cloudflare\u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the \u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e/_next/image\u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e endpoint.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eFor example:\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e\u003ci\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://victim-site.com/_next/image?url=https://attacker.com\\\"\u003ehttps://victim-site.com/_next/image?url=https://attacker.com\u003c/a\u003e\u003c/i\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eIn this example, attacker-controlled content from attacker.com is served through the victim site\\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\u003c/span\u003e\u003c/p\u003e\u003cb\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eImpact:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eSSRF via unrestricted remote URL loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eArbitrary remote content loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ePotential internal service exposure or phishing risks through domain abuse\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cb\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eMitigation:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eThe following mitigations have been put in place:\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eServer side updates to Cloudflare\\u2019s platform to restrict the content loaded via the\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e/_next/image\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eendpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/opennextjs/opennextjs-cloudflare/pull/727\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eRoot cause fix\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\\\"background-color: transparent;\\\"\u003eto the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u0026nbsp;\u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e@opennextjs/cloudflare@1.3.0\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/cloudflare/workers-sdk/pull/9608\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ePackage dependency update\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\\\"background-color: transparent;\\\"\u003eto create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u0026nbsp;\u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.npmjs.com/package/create-cloudflare/v/2.49.3\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ecreate-cloudflare@2.49.3\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eIn addition to the automatic mitigation deployed on Cloudflare\\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eremotePatterns \u003c/span\u003e\u003c/a\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003efilter in Next config\u003c/span\u003e\u003c/a\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003e if they need to allow-list external urls with images assets.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a22f1246-ba21-4bb4-a601-ad51614c1513\", \"shortName\": \"cloudflare\", \"dateUpdated\": \"2025-06-16T18:30:44.180Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-6087\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-16T18:55:53.269Z\", \"dateReserved\": \"2025-06-14T02:12:00.423Z\", \"assignerOrgId\": \"a22f1246-ba21-4bb4-a601-ad51614c1513\", \"datePublished\": \"2025-06-16T18:30:44.180Z\", \"assignerShortName\": \"cloudflare\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-RVPW-P7VW-WJ3M

Vulnerability from github – Published: 2025-06-16 19:37 – Updated: 2025-06-16 21:46

Summary

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package.

The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.

This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com. In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Impact

SSRF via unrestricted remote URL loading
Arbitrary remote content loading
Potential internal service exposure or phishing risks through domain abuse

Mitigation

The following mitigations have been put in place:

Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next

Root cause fix: Pull request https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0

Package dependency update: Pull request https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found at create-cloudflare@2.49.3.

In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns filter in Next config if they need to allow-list external urls with images assets.

Credits

Disclosed responsibly by security researcher Edward Coristine. Thank you for the report.

References

https://www.cve.org/cverecord?id=CVE-2025-6087

Severity ?

7.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opennextjs/cloudflare"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6087"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-16T19:37:16Z",
    "nvd_published_at": "2025-06-16T19:15:33Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. \n\nThe vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the `/_next/image` endpoint. \n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.  For example: `https://victim-site.com/_next/image?url=https://attacker.com`. In this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (`victim-site.com`), violating the same-origin policy and potentially misleading users or other services.\n\n### Impact\n\n- SSRF via unrestricted remote URL loading \n- Arbitrary remote content loading \n- Potential internal service exposure or phishing risks through domain abuse \n\n\n### Mitigation\n\nThe following mitigations have been put in place: \n\n**Server side updates** to Cloudflare\u2019s platform to restrict the content loaded via the `/_next/image` endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next \n\n**Root cause fix**: Pull request https://github.com/opennextjs/opennextjs-cloudflare/pull/727  to the Cloudflare adapter for Open Next. The patched version of the adapter is found here  [@opennextjs/cloudflare@1.3.0](https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0)\n\n**Package dependency update**: Pull request https://github.com/cloudflare/workers-sdk/pull/9608  to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found at [create-cloudflare@2.49.3](https://www.npmjs.com/package/create-cloudflare/v/2.49.3).\n\n In addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the [remotePatterns](https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns) filter in Next config if they need to allow-list external urls with images assets.\n\n### Credits\n\nDisclosed responsibly by security researcher Edward Coristine. Thank you for the report.\n\n### References\n\nhttps://www.cve.org/cverecord?id=CVE-2025-6087",
  "id": "GHSA-rvpw-p7vw-wj3m",
  "modified": "2025-06-16T21:46:51Z",
  "published": "2025-06-16T19:37:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-rvpw-p7vw-wj3m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6087"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/workers-sdk/pull/9608"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/pull/727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/36119c0f490c95b3d4f6e826d745b728c80625ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint"
}

FKIE_CVE-2025-6087

Vulnerability from fkie_nvd - Published: 2025-06-16 19:15 - Updated: 2025-08-06 17:21

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	cna@cloudflare.com	https://github.com/opennextjs/opennextjs-cloudflare	Product

Impacted products

	Vendor	Product	Version
	cloudflare	create-cloudflare	*
	opennextjs	opennext_for_cloudflare	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:create-cloudflare:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "75F34FC9-679E-4655-B803-E84B045271CC",
              "versionEndExcluding": "2.49.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opennextjs:opennext_for_cloudflare:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "0EDFEC99-0FB1-4E53-9FC6-DDD1C68AA214",
              "versionEndExcluding": "1.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n  *  SSRF via unrestricted remote URL loading\n\n\n\n\n  *  Arbitrary remote content loading\n\n\n\n\n  *  Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n  *  Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets."
    },
    {
      "lang": "es",
      "value": "Se identific\u00f3 una vulnerabilidad de Server-Side Request Forgery (SSRF) en el paquete @opennextjs/cloudflare. Esta vulnerabilidad se debe a una funci\u00f3n no implementada en el adaptador de Cloudflare para Open Next, que permit\u00eda a usuarios no autenticados acceder a contenido remoto arbitrario mediante el endpoint /_next/image. Este problema permit\u00eda a los atacantes cargar recursos remotos desde hosts arbitrarios bajo el dominio del sitio web v\u00edctima para cualquier sitio implementado con el adaptador de Cloudflare para Open Next. Por ejemplo: https://victim-site.com/_next/image?url=https://attacker.com. En este ejemplo, el contenido controlado por el atacante desde attacker.com se distribuye a trav\u00e9s del dominio del sitio web v\u00edctima (victim-site.com), lo que infringe la pol\u00edtica de mismo origen y podr\u00eda inducir a error a usuarios u otros servicios. Impacto: * SSRF mediante carga remota de URL sin restricciones * Carga remota arbitraria de contenido * Posible exposici\u00f3n interna del servicio o riesgos de phishing por abuso de dominio. Mitigaci\u00f3n: Se han implementado las siguientes mitigaciones: * Actualizaciones del servidor en la plataforma de Cloudflare para restringir el contenido cargado a trav\u00e9s del endpoint /_next/image a im\u00e1genes. La actualizaci\u00f3n mitiga autom\u00e1ticamente el problema en todos los sitios existentes y futuros implementados en Cloudflare que utilicen la versi\u00f3n afectada del adaptador de Cloudflare para Open Next. * Correcci\u00f3n de la causa ra\u00edz (https://github.com/opennextjs/opennextjs-cloudflare/pull/727) en el adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada del adaptador se encuentra aqu\u00ed @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Actualizaci\u00f3n de la dependencia del paquete https://github.com/cloudflare/workers-sdk/pull/9608 para create-cloudflare (c3) para usar la versi\u00f3n corregida del adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada de create-cloudflare se encuentra aqu\u00ed: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 Adem\u00e1s de la mitigaci\u00f3n autom\u00e1tica implementada en la plataforma de Cloudflare, recomendamos a los usuarios afectados que actualicen a @opennext/cloudflare v1.3.0 y utilicen el filtro remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns en la configuraci\u00f3n de Next https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns si necesitan incluir en la lista de permitidos URL externas con recursos de im\u00e1genes."
    }
  ],
  "id": "CVE-2025-6087",
  "lastModified": "2025-08-06T17:21:28.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@cloudflare.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-16T19:15:33.837",
  "references": [
    {
      "source": "cna@cloudflare.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/opennextjs/opennextjs-cloudflare"
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "cna@cloudflare.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-6087 (GCVE-0-2025-6087)

GHSA-RVPW-P7VW-WJ3M

Impact

Mitigation

Credits

References

FKIE_CVE-2025-6087

Tags

Sightings

Nomenclature