updates

Author: penalosa

src/content/changelog/workers/2025-06-17-open-next-ssrf.mdx

@@ -1,14 +1,20 @@
 ---
-title: SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
-description: A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, which has been automatically mitigated for all existing deployments.
+title: SSRF vulnerability in @opennextjs/cloudflare proactively mitigated for all Cloudflare customers
+description: Mitigations have been put in place for all existing and future deployments of sites with the Cloudflare adapter for Open Next in response to an identified Server-Side Request Forgery (SSRF) vulnerability in the @opennextjs/cloudflare package
 products:
   - workers
 date: 2025-06-17T01:00:00Z
 ---
 
+<<<<<<< HEAD
 A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, which has been automatically mitigated for all Next.js apps deployed to Cloudflare that use the @opennextjs/cloudflare package.
+||||||| parent of 0aa4c5a3c9 (updates)
+A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, which has been automatically mitigated for all existing deployments.
+=======
+Mitigations have been put in place for all existing and future deployments of sites with the Cloudflare adapter for Open Next in response to an identified Server-Side Request Forgery (SSRF) vulnerability in the `@opennextjs/cloudflare` package
+>>>>>>> 0aa4c5a3c9 (updates)
 
-The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed users to proxy arbitrary remote content via the `/_next/image` endpoint.
+The vulnerability stemmed from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed users to proxy arbitrary remote content via the `/_next/image` endpoint.
 
 This issue allowed attackers to load remote resources from arbitrary hosts under the victim site's domain for any site deployed using the Cloudflare adapter for Open Next. For example: `https://victim-site.com/_next/image?url=https://attacker.com`. In this example, attacker-controlled content from `attacker.com` is served through the victim site's domain (`victim-site.com`), violating the same-origin policy and potentially misleading users or other services.