Open Next for Cloudflare SSRF Vulnerability Let Attackers Load Remote Resources from Arbitrary Hosts
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A high-severity Server-Side Request Forgery (SSRF) vulnerability<\/a> has been identified in the @opennextjs\/cloudflare package, enabling attackers to exploit the \/_next\/image endpoint to load remote resources from arbitrary hosts.\u00a0<\/p>\n The vulnerability, assigned CVE-2025-6087 with a CVSS score of 7.8, affects all versions prior to 1.3.0 and was disclosed by security researcher Edward Coristine.<\/p>\n The SSRF vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, specifically targeting the \/_next\/image endpoint.\u00a0<\/p>\n This security flaw allows unauthenticated users to proxy arbitrary remote content through victim domains without proper validation or restrictions.\u00a0<\/p>\n The attack vector operates through a simple URL manipulation technique where malicious actors can craft requests such as https:\/\/victim-site.com\/_next\/image?url=https:\/\/attacker.com.<\/p>\n The vulnerability is classified under CWE-918 (Server-Side Request Forgery) and demonstrates significant exploitability metrics with Network attack<\/a> vector, Low complexity, and None required privileges or user interaction.\u00a0<\/p>\n This combination makes the vulnerability particularly dangerous as it requires no authentication or special conditions to exploit.<\/p>\n The security impact encompasses multiple attack vectors, including SSRF via unrestricted remote URL loading and arbitrary remote content loading.<\/p>\n Attackers can leverage this vulnerability to serve malicious content through legitimate victim domains, effectively violating the same-origin policy and potentially misleading users or automated services.<\/p>\n The vulnerability presents risks for internal service exposure and phishing attacks through domain abuse.\u00a0<\/p>\n When exploited, attacker-controlled content from external domains appears to originate from the victim\u2019s trusted domain, creating opportunities for social engineering attacks and bypassing security controls that rely on domain reputation.<\/p>\nSSRF Vulnerability in Cloudflare Adapter for Open Next<\/strong><\/h2>\n