Does @opennextjs/cloudflare survive CVE-2025-66478
Hi. I use cloudflare workers and [opennextjs](https://github.com/opennextjs/opennextjs-cloudflare) to deploy my NextJs project. I upgraded NextJs a few days after CVE-2025-66478 got reported. Cloudflare workers says they [disallow `eval`](https://developers.cloudflare.com/workers/runtime-apis/web-standards/#javascript-standards) and other functions related to dynamic code execution. So is it possible that my cloudflare workers nextjs project has been hacked? Do I need to invalidate the secrets stored in my cloudflare workers env?
Posted Dec 11, 2025, 9:57 AM UTC
15