npm / @opennextjs/cloudflare
@opennextjs/cloudflare
What changed in @opennextjs/cloudflare 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.
4 breaking3 security6 new APIs and options2 performance3 behavior and defaults26 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@opennextjs/cloudflare 144 changes
Breaking changes 4
Raises the supported version floor to 15.5.27 and 16.3.8 to include the latest security fixes.
Raises the supported Next.js version floor to 15.5.26 or 16.3.6 because versions 16.2.0 through 16.3.5 are affected by a critical next/og remote code execution vulnerability.
The override of process.version is removed; unenv now provides the behavior.
The override of process.versions.node is removed; unenv now provides the behavior.
Security 3
Encoded paths are handled safely so they cannot bypass middleware matching or select partially decoded cache entries.
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
New APIs and options 6
Adds experimental support for Next.js Node.js middleware, bundling it into a Workers-compatible handler; requires the nodejs_compat compatibility flag.
Provide this credential when using the opt-in rclone upload path for remote cache population.
Add --rclone to opt in to rclone-based batch uploads when populating a remote R2 cache; the worker-based path remains the default.
Provide this credential when using the opt-in rclone upload path for remote cache population.
Provide this credential when using the opt-in rclone upload path for remote cache population.
An optional peer dependency used for rclone-based batch uploads to populate a remote R2 cache.
Performance 2
When the app does not use ImageResponse or opengraph-image, the real @vercel/og library is no longer pulled into the Worker bundle, reducing bundle size.
Large repeated values are factored in manifests, reducing the size of generated code.
Behavior and default changes 3
R2 can be populated when the domain is protected by Cloudflare Access; configure a Service Auth policy and set CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET.
R2 cache uploads now retry up to 15 times with capped exponential backoff, improving resilience against transient write failures during cache population.
Build condition transforms now support object-valued conditions and prune siblings unless their subtree also contains the build condition.
Fixes and other changes 26
Next.js 15 builds no longer fail as unsupported now that Next.js 15 is two years old; a major version stays supported until the second next major is released.
Server action redirects now use the host of the request.
Named webpack chunks are bundled into the Worker and load correctly, fixing 500 errors when server code loads chunks named with webpackChunkName.
Adds support for Next.js 16.4.
Includes preview-props.json in loadManifest build-time inlining.
The Node.js middleware no longer bundles @vercel/og when it is not used.
Image responses now use the format produced by the Images binding, so the Content-Type matches the image bytes when the binding falls back to another format.
The build no longer logs
Failed to copyfor packages whose exports is a string.The build skips route directories matching internal manifest globs, avoiding EISDIR errors or unresolved imports; only manifest files are inlined.
Isolates module-loading cache signals between requests to prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic when timers cross Cloudflare Worker request contexts.
Renaming esbuild's __require helper now skips property accesses, avoiding SSR failures for packages with @rollup/plugin-commonjs lazy-init wrappers.
Replaces the whole loadCustomCacheHandlers method body so Next.js 16.3 runtime chunks no longer fail with ReferenceError; older versions remain unaffected.
The missing optional dependency stub now sets the MODULE_NOT_FOUND code, allowing Next.js to fall back to react-dom/server.browser.
Stubs out the instrumentation loader in the Node.js middleware bundle, avoiding unsupported dynamic requires while the server function continues registering the hook.
Turbopack chunks are patched for both server and Node.js middleware bundles so wasm-backed imports do not rely on workerd’s unsupported WebAssembly.compileStreaming.
Normalizes Windows paths when patching the Turbopack runtime so traced chunks are included in generated runtime loaders on Windows builds.
Response compression is disabled for skew protection API requests to avoid truncated Cloudflare API responses causing worker version lookups to fail during deployment.
Response compression is disabled during provisioning to avoid truncated compressed Cloudflare API responses causing provisioning to fail.
Tag purges now reach the Cloudflare cache instead of failing on multi-tag binding counts, preventing stale pages when bypassTagCacheOnCacheHit is enabled.
Metadata-only worker versions are filtered out so they cannot become the latest target and cause /_next/static/* requests on past deployments to return 404.
Expected SQLite errors when the D1 tag-cache columns already exist are no longer logged.
Turbopack WebAssembly loading uses synchronous instantiation and statically imported chunks because streaming WebAssembly calls are unavailable in workerd.
Adds missing Git-ignored files to the migrate command.
Cache keys now use OPEN_NEXT_BUILD_ID instead of NEXT_BUILD_ID, which can be fixed when deploymentId is set explicitly in Next 16.2.
Fixes the logic that determines whether the tag cache is stale.
When required config is missing, prompts in non-TTY environments now fail with actionable guidance instead of hanging or failing cryptically; interactive behavior is unchanged.