Skip to content

Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY]#331

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-opennextjs-cloudflare-vulnerability
Open

Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY]#331
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-opennextjs-cloudflare-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 5, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
@opennextjs/cloudflare (source) 1.6.2 → 1.17.1 age confidence

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

CVE-2026-3125 / GHSA-c7mq-gh6q-6q7c

More information

Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @​opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.

The @​opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs.

For example: https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com

In this example, attacker-controlled content from attacker.com is served through the victim site's domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Note: This bypass only works via HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is). Browsers normalize backslashes to forward slashes before sending requests.

Additionally, Cloudflare Workers with Assets and Cloudflare Pages suffer from a similar vulnerability. Assets stored under /cdn-cgi/ paths are not publicly accessible under normal conditions. However, using the same backslash bypass (/cdn-cgi... instead of /cdn-cgi/...), these assets become publicly accessible. This could be used to retrieve private data. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

Impact
  • SSRF via path normalization bypass of Cloudflare edge interception
  • Arbitrary remote content loading under the victim site's domain
  • Same-origin policy bypass
  • Potential for infrastructure abuse (scanning from Cloudflare IP space, worker resource exhaustion)
  • Exposure of private assets stored under /cdn-cgi/ paths. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.
Credits

Disclosed responsibly by security researcher @​Ezzer17.

Mitigations

The following mitigations have been put in place:

Server-side updates to Cloudflare's Workers platform to block backslash path normalization bypasses for /cdn-cgi requests. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare Workers.

In addition to the platform level fix, Root cause fix has been implemented to the Cloudflare adapter for Open Next. The patched version of the adapter is found at @​opennextjs/cloudflare@1.17.1 (https://www.npmjs.com/package/@​opennextjs/cloudflare)

Dependency update to the Next.js template used with create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. Despite the automatic mitigation deployed on Cloudflare's platform, we encourage affected users to upgrade to the patched version of @​opennextjs/cloudflare.

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.17.1

Compare Source

Patch Changes

v1.17.0

Compare Source

Minor Changes
  • #​1133 25d5835 Thanks @​dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

v1.16.6

Compare Source

Patch Changes
  • #​1138 4487f1f Thanks @​james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

v1.16.5

Compare Source

Patch Changes

v1.16.4

Compare Source

Patch Changes

v1.16.3

Compare Source

Patch Changes

v1.16.2

Compare Source

Patch Changes

v1.16.1

Compare Source

Patch Changes

v1.16.0

Compare Source

Minor Changes

  • #​1083 b062597 Thanks @​dario-piotrowicz! - feature: add migrate command to set up OpenNext for Cloudflare adapter

    This command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.

    To use the command simply run: npx opennextjs-cloudflare migrate

Patch Changes

  • #​1092 4279043 Thanks @​vicb! - Check for supported Next version

    The build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
    You can bypass the check using the --dangerouslyUseUnsupportedNextVersion flag.

v1.15.1

Compare Source

Patch Changes

v1.15.0

Compare Source

Minor Changes
Patch Changes

v1.14.10

Compare Source

Patch Changes

v1.14.9

Compare Source

Patch Changes

v1.14.8

Compare Source

Patch Changes

v1.14.7

Compare Source

Patch Changes

v1.14.6

Compare Source

Patch Changes

v1.14.5

Compare Source

Patch Changes

v1.14.4

Compare Source

Patch Changes

v1.14.3

Compare Source

Patch Changes

v1.14.2

Compare Source

Patch Changes

v1.14.1

Compare Source

Patch Changes

v1.14.0

Compare Source

Minor Changes

v1.13.1

Compare Source

Patch Changes

v1.13.0

Compare Source

Minor Changes
Patch Changes

v1.12.0

Compare Source

Minor Changes

v1.11.1

Compare Source

Patch Changes

v1.11.0

Compare Source

Minor Changes

  • #​925 62fee71 Thanks @​krzysztof-palka-monogo! - feature: optional batch upload for faster R2 cache population

    This update adds optional batch upload support for R2 cache population, significantly improving upload performance for large caches when enabled via .env or environment variables.

    Key Changes:

    1. Optional Batch Upload: Configure R2 credentials via .env or environment variables to enable faster batch uploads:

      • R2_ACCESS_KEY_ID
      • R2_SECRET_ACCESS_KEY
      • CF_ACCOUNT_ID

    2. Automatic Detection: When credentials are detected, batch upload is automatically used for better performance

    3. Smart Fallback: If credentials are not configured, the CLI falls back to standard Wrangler uploads with a helpful message about enabling batch upload for better performance

    All deployment commands support batch upload:

    • populateCache - Explicit cache population
    • deploy - Deploy with cache population
    • upload - Upload version with cache population
    • preview - Preview with cache population

    Performance Benefits (when batch upload is enabled):

    • Parallel transfer capabilities (32 concurrent transfers)
    • Significantly faster for large caches
    • Reduced API calls to Cloudflare

    Usage:

    Add the credentials in a .env/.dev.vars file in your project root:

    R2_ACCESS_KEY_ID=your_key
R2_SECRET_ACCESS_KEY=your_secret
CF_ACCOUNT_ID=your_account

    You can also set the environment variables for CI builds.

    Note:

    You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.

Patch Changes

v1.10.1

Compare Source

Patch Changes

v1.10.0

Compare Source

Minor Changes

  • #​937 32ba91a Thanks @​vicb! - feat: retrieve CLI environment variables from process.env and .env* files

    Recommended usage on CI:

    • Add your secrets to process.env (i.e. CF_ACCOUNT_ID)
    • Add public values to the wrangler config wrangler.jsonc (i.e. R2_CACHE_PREFIX_ENV_NAME)

    Recommended usage for local dev:

    • Add your secrets to either a .dev.vars* or .env* file (i.e. CF_ACCOUNT_ID)
    • Add public values to the wrangler config wrangler.jsonc (i.e. R2_CACHE_PREFIX_ENV_NAME)
Patch Changes

v1.9.2

Compare Source

Patch Changes

v1.9.1

Compare Source

Patch Changes

v1.9.0

Compare Source

Minor Changes
Patch Changes

v1.8.5

Compare Source

Patch Changes

  • #​901 17a4bea Thanks @​vicb! - chore: bump wrangler to ^4.38.0

  • #​903 7fced0f Thanks @​vicb! - fix: enable using workerd process v2

    process v2 is an updated version of node:process active by default after 2025-09-15

v1.8.4

Compare Source

Patch Changes

  • #​888 51322a8 Thanks @​james-elicx! - fix: remote flag not working for preview command's cache population

    Previously, passing the --remote flag when running opennextjs-cloudflare preview --remote would not result in the remote preview binding being populated, and would throw errors due to a missing preview flag when populating Workers KV. The remote flag is now supported for the cache popoulation step when running the preview command.

    • opennextjs-cloudflare preview --remote will populate the remote binding for the preview ID specified in your Wrangler config.
    • opennextjs-cloudflare preview will continue to populate the local binding in your Wrangler config.

v1.8.3

Compare Source

Patch Changes

v1.8.2

Compare Source

Patch Changes

v1.8.1

Compare Source

Patch Changes

v1.8.0

Compare Source

Minor Changes
Patch Changes

v1.7.1

Compare Source

Patch Changes

v1.7.0

Compare Source

Minor Changes

  • #​848 f80c801 Thanks @​sommeeeer! - Ensure that the initial request.signal is passed to the wrapper

    request.signal.onabort is now supported in route handlers. It requires that the signal from the original worker's request is passed to the handler. It will then pass along that AbortSignal through the streamCreator in the wrapper. This signal will destroy the response sent to NextServer when a client aborts, thus triggering the signal in the route handler.

    See the changelog in Cloudflare here.

    Note:
    If you have a custom worker, you must update your code to pass the original request.signal to the handler. You also need to enable the compatibility flag enable_request_signal to use this feature.

    For example:

    // Before:
return handler(reqOrResp, env, ctx);

// After:
return handler(reqOrResp, env, ctx, request.signal);

  • #​850 ce5c7b4 Thanks @​dario-piotrowicz! - Add option for regional cache to skip tagCache on cache hits

    When the tag regional cache finds a value in the incremental cache, checking such value in the tagCache can be skipped, this helps reducing response times at the tradeoff that the user needs to either use the automatic cache purging or manually purge the cache when appropriate. For this the bypassTagCacheOnCacheHit option is being added to the RegionalCache class.

    Example:

    import { defineCloudflareConfig } from "@​opennextjs/cloudflare";
import d1NextTagCache from "@​opennextjs/cloudflare/overrides/tag-cache/d1-next-tag-cache";
import memoryQueue from "@​opennextjs/cloudflare/overrides/queue/memory-queue";
import r2IncrementalCache from "@​opennextjs/cloudflare/overrides/incremental-cache/r2-incremental-cache";
import { withRegionalCache } from "@​opennextjs/cloudflare/overrides/incremental-cache/regional-cache";

export default defineCloudflareConfig({
	incrementalCache: withRegionalCache(r2IncrementalCache, {
		mode: "long-lived",
		bypassTagCacheOnCacheHit: true,
	}),
	tagCache: d1NextTagCache,
	queue: memoryQueue,
});
Patch Changes

v1.6.5

Compare Source

Patch Changes

v1.6.4

Compare Source

Patch Changes

v1.6.3

Compare Source

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot enabled auto-merge (squash) March 5, 2026 05:13
@socket-security

socket-security Bot commented Mar 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​opennextjs/​cloudflare@​1.6.2 ⏵ 1.17.198100 +1690 +295100

View full report

@socket-security

socket-security Bot commented Mar 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Trivial package: npm @aws-sdk/middleware-host-header has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@aws-sdk/middleware-host-header@3.972.12

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/middleware-host-header@3.972.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @aws-sdk/middleware-logger has 7 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@aws-sdk/middleware-logger@3.972.11

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/middleware-logger@3.972.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @aws-sdk/middleware-recursion-detection has 7 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@aws-sdk/middleware-recursion-detection@3.972.13

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/middleware-recursion-detection@3.972.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @aws-sdk/middleware-user-agent has 10 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@aws-sdk/middleware-user-agent@3.972.41

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/middleware-user-agent@3.972.41. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @aws-sdk/util-user-agent-browser has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@aws-sdk/util-user-agent-browser@3.972.12

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@aws-sdk/util-user-agent-browser@3.972.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/eventstream-serde-config-resolver has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/eventstream-serde-config-resolver@4.4.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/eventstream-serde-config-resolver@4.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/eventstream-serde-node has 10 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/eventstream-serde-node@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/eventstream-serde-node@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/hash-blob-browser has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/hash-blob-browser@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/hash-blob-browser@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/hash-node has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/hash-node@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/hash-node@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/hash-stream-node has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/hash-stream-node@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/hash-stream-node@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/invalid-dependency has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/invalid-dependency@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/invalid-dependency@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/md5-js has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/md5-js@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/md5-js@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/middleware-content-length has 10 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/middleware-content-length@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/middleware-content-length@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/middleware-stack has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/middleware-stack@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/middleware-stack@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/node-config-provider has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/node-config-provider@4.4.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/node-config-provider@4.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/url-parser has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/url-parser@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/url-parser@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-base64 has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-base64@4.4.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-base64@4.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-body-length-browser has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-body-length-browser@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-body-length-browser@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-body-length-node has 8 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-body-length-node@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-body-length-node@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-defaults-mode-browser has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-defaults-mode-browser@4.4.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-defaults-mode-browser@4.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-defaults-mode-node has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-defaults-mode-node@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-defaults-mode-node@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @smithy/util-middleware has 9 lines of code

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@smithy/util-middleware@4.3.3

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/util-middleware@4.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Publisher changed: npm content-type is now published by blakeembrey

Author: blakeembrey

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/content-type@2.0.0

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/content-type@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Publisher changed: npm type-is is now published by blakeembrey

Author: blakeembrey

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/type-is@2.1.0

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/type-is@2.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm @ast-grep/napi in module child_process

Module: child_process

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@ast-grep/napi@0.40.5

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ast-grep/napi@0.40.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm @dotenvx/dotenvx in module child_process

Module: child_process

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@dotenvx/dotenvx@1.31.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@dotenvx/dotenvx@1.31.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Potential vulnerability: npm @dotenvx/dotenvx with risk level "medium"

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/@dotenvx/dotenvx@1.31.0

ℹ Read more on: This package | This alert | Navigating potential vulnerabilities

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@dotenvx/dotenvx@1.31.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm cross-spawn in module child_process

Module: child_process

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/cross-spawn@7.0.6

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cross-spawn@7.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 41 more rows in the dashboard

View full report

@renovate renovate Bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from 01d9d6c to e6f3535 Compare March 13, 2026 17:02
@renovate renovate Bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from e6f3535 to 33a8327 Compare March 22, 2026 18:56
@renovate renovate Bot changed the title Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security] Mar 22, 2026
@renovate renovate Bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from 33a8327 to 22cefa6 Compare March 26, 2026 18:18
@renovate renovate Bot changed the title chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security] Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] Apr 8, 2026
@renovate renovate Bot changed the title Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
auto-merge was automatically disabled April 27, 2026 17:05

Pull request was closed

@renovate renovate Bot deleted the renovate/npm-opennextjs-cloudflare-vulnerability branch April 27, 2026 17:05
@renovate renovate Bot changed the title Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] - autoclosed Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch 2 times, most recently from 22cefa6 to 06beae8 Compare April 27, 2026 21:04
@renovate renovate Bot enabled auto-merge (squash) May 18, 2026 18:49
@renovate renovate Bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from 06beae8 to 24244d5 Compare May 18, 2026 18:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants