CVE-2026-100409 affects OpenNextJS @opennextjs/cloudflare, the Next.js adapter for Cloudflare. Versions 0.3.0 through earlier than 1.20.2 can serve cached protected content to unauthenticated requests through percent-encoded paths that bypass authorization middleware. Upgrade to 1.20.2. https://github.com/opennextjs/opennextjs-cloudflare/security/advisories/GHSA-2vc4-c4r6-p6v6 #CloudSecurity #infosec #cybersecurity