CVE-2025-6087

score

<0.1

cvss

9.1

epss

1.0%

published

2025-06-16

kev added

—

first seen

2026-10-21

@opennextjs/cloudflare contains a server-side request forgery caused by unimplemented filtering in the Cloudflare adapter's /_next/image endpoint, letting unauthenticated attackers proxy arbitrary remote content, exploit requires no special privileges.