github - ghsa-rvpw-p7vw-wj3m

GHSA-RVPW-P7VW-WJ3M

Vulnerability from github – Published: 2025-06-16 19:37 – Updated: 2025-06-16 21:46

Summary

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package.

The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.

This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com. In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Impact

SSRF via unrestricted remote URL loading
Arbitrary remote content loading
Potential internal service exposure or phishing risks through domain abuse

Mitigation

The following mitigations have been put in place:

Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next

Root cause fix: Pull request https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0

Package dependency update: Pull request https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found at create-cloudflare@2.49.3.

In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns filter in Next config if they need to allow-list external urls with images assets.

Credits

Disclosed responsibly by security researcher Edward Coristine. Thank you for the report.

References

https://www.cve.org/cverecord?id=CVE-2025-6087

Severity ?

7.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opennextjs/cloudflare"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6087"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-16T19:37:16Z",
    "nvd_published_at": "2025-06-16T19:15:33Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. \n\nThe vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the `/_next/image` endpoint. \n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.  For example: `https://victim-site.com/_next/image?url=https://attacker.com`. In this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (`victim-site.com`), violating the same-origin policy and potentially misleading users or other services.\n\n### Impact\n\n- SSRF via unrestricted remote URL loading \n- Arbitrary remote content loading \n- Potential internal service exposure or phishing risks through domain abuse \n\n\n### Mitigation\n\nThe following mitigations have been put in place: \n\n**Server side updates** to Cloudflare\u2019s platform to restrict the content loaded via the `/_next/image` endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next \n\n**Root cause fix**: Pull request https://github.com/opennextjs/opennextjs-cloudflare/pull/727  to the Cloudflare adapter for Open Next. The patched version of the adapter is found here  [@opennextjs/cloudflare@1.3.0](https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0)\n\n**Package dependency update**: Pull request https://github.com/cloudflare/workers-sdk/pull/9608  to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found at [create-cloudflare@2.49.3](https://www.npmjs.com/package/create-cloudflare/v/2.49.3).\n\n In addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the [remotePatterns](https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns) filter in Next config if they need to allow-list external urls with images assets.\n\n### Credits\n\nDisclosed responsibly by security researcher Edward Coristine. Thank you for the report.\n\n### References\n\nhttps://www.cve.org/cverecord?id=CVE-2025-6087",
  "id": "GHSA-rvpw-p7vw-wj3m",
  "modified": "2025-06-16T21:46:51Z",
  "published": "2025-06-16T19:37:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-rvpw-p7vw-wj3m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6087"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/workers-sdk/pull/9608"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/pull/727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare/commit/36119c0f490c95b3d4f6e826d745b728c80625ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opennextjs/opennextjs-cloudflare"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint"
}

CVE-2025-6087 (GCVE-0-2025-6087)

Vulnerability from cvelistv5 – Published: 2025-06-16 18:30 – Updated: 2025-06-16 18:55

Summary

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services. Impact: * SSRF via unrestricted remote URL loading * Arbitrary remote content loading * Potential internal service exposure or phishing risks through domain abuse Mitigation: The following mitigations have been put in place: * Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next * Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets.

Severity ?

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

cloudflare

References

URL

Tags

https://github.com/opennextjs/opennextjs-cloudflare

Impacted products

	Vendor	Product	Version
			Affected: 0 , < 1.3.0 (git)

Credits

Edward Coristine

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-16T18:55:28.409358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T18:55:53.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/opennextjs",
          "defaultStatus": "unaffected",
          "packageName": "opennextjs-cloudflare",
          "repo": "https://github.com/opennextjs/opennextjs-cloudflare",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Edward Coristine"
        }
      ],
      "datePublic": "2025-06-15T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eA Server-Side Request Forgery (SSRF) vulnerability was identified in the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e@opennextjs/cloudflare\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e/_next/image\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e endpoint.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eFor example:\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003ci\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://victim-site.com/_next/image?url=https://attacker.com\"\u003ehttps://victim-site.com/_next/image?url=https://attacker.com\u003c/a\u003e\u003c/i\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\u003c/span\u003e\u003c/p\u003e\u003cb\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eImpact:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eSSRF via unrestricted remote URL loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eArbitrary remote content loading\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003ePotential internal service exposure or phishing risks through domain abuse\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cb\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eMitigation:\u003c/span\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThe following mitigations have been put in place:\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eServer side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e/_next/image\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003eendpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/opennextjs/opennextjs-cloudflare/pull/727\"\u003e\u003cspan style=\"background-color: transparent;\"\u003eRoot cause fix\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\"background-color: transparent;\"\u003eto the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0\"\u003e\u003cspan style=\"background-color: transparent;\"\u003e@opennextjs/cloudflare@1.3.0\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/cloudflare/workers-sdk/pull/9608\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ePackage dependency update\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan style=\"background-color: transparent;\"\u003eto create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.npmjs.com/package/create-cloudflare/v/2.49.3\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ecreate-cloudflare@2.49.3\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\"background-color: transparent;\"\u003eIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\"\u003e\u003cspan style=\"background-color: transparent;\"\u003eremotePatterns \u003c/span\u003e\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns\"\u003e\u003cspan style=\"background-color: transparent;\"\u003efilter in Next config\u003c/span\u003e\u003c/a\u003e\u003cspan style=\"background-color: transparent;\"\u003e if they need to allow-list external urls with images assets.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n  *  SSRF via unrestricted remote URL loading\n\n\n\n\n  *  Arbitrary remote content loading\n\n\n\n\n  *  Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n  *  Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-16T18:30:44.180Z",
        "orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
        "shortName": "cloudflare"
      },
      "references": [
        {
          "url": "https://github.com/opennextjs/opennextjs-cloudflare"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
    "assignerShortName": "cloudflare",
    "cveId": "CVE-2025-6087",
    "datePublished": "2025-06-16T18:30:44.180Z",
    "dateReserved": "2025-06-14T02:12:00.423Z",
    "dateUpdated": "2025-06-16T18:55:53.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-RVPW-P7VW-WJ3M

Impact

Mitigation

Credits

References

CVE-2025-6087 (GCVE-0-2025-6087)

Tags

Sightings

Nomenclature