Repository navigation

Security

Report a vulnerability

SECURITY.md

Security Policy

https://www.cloudflare.com/disclosure

Reporting a Vulnerability

https://hackerone.com/cloudflare
- All Cloudflare products are in scope for reporting. If you submit a valid report on bounty-eligible assets through our disclosure program, we will transfer your report to our private bug bounty program and invite you as a participant.

All abuse reports should be submitted to our Trust & Safety team through our dedicated page: https://www.cloudflare.com/abuse/

Very long cache keys could collide and share cache entries between requests, as could unstable_cache callbacks with the same keyParts
GHSA-2956-r8mj-w5c4 published Oct 14, 2026 by james-elicx

Moderate
Server Action closures could be swapped between actions with @vitejs/plugin-rsc < 0.5.37, and inline "use cache" closures could be forged
GHSA-8969-277p-8rrm published Oct 14, 2026 by james-elicx

High

Learn more about advisories related to cloudflare/vinext in the GitHub Advisory Database