Nextjs app compromised even with cf acess enabld

Hey,

I’m trying to understand a recent security incident and would appreciate any help

I had a Next.js app using the app router running on a server which had the vulnreble next.js version with CVE-2025-66478, bound to 127.0.0.1, not exposed publicly. I also had Cloudflare Zero Trust enabled on the domain (tools.jbz.dev), with rules that block everyone except me. . I would assume though that cloudflare zero trust access would redirect any request back to the auth page but multiple requests still managed to reach the server.

The Next.js app and the backend which was quart was bound to localhost so I doubt it would be the server ip that was accessed instead of the actual url it was hosted on.

Cloudflare Zero Trust was active, so public requests should not reach the app.

im so confused on how this happened

logs.txt58.38KB

Erisa•12/8/25, 1:29 PM

the third screenshot you shared shows that the app was listening on a public ip, so it makes sense that the attacker may have connected over that?

Erisa•12/8/25, 1:29 PM

as well as not listening on public ip, to prevent this properly your application should be verifying the jwt from Access

Erisa•12/8/25, 1:29 PM

https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/

Cloudflare Docs

Validate JWTs

When Cloudflare sends a request to your origin, the request will include an application token as a Cf-Access-Jwt-Assertion request header. Requests made through a browser will also pass the token as a CF_Authorization cookie.

EErisa as well as not listening on public ip, to prevent this properly your application...

wawaOP•12/11/25, 10:55 AM

i missed that, thanks a lot. it's confusing how they connected to the ip diectly since I used 127.0.0.1

wawaOP•12/11/25, 10:55 AM

i probably restarted it weird

Erisa•12/11/25, 10:56 AM

i can see the 127.0.0.1 in the options on that screenshot but the public ip is also visible in the output

Erisa•12/11/25, 10:56 AM

maybe nextjs handled that option weirdly

Erisa•12/11/25, 10:56 AM

regardless though, you should be validating the access jwt, thats also really important

Erisa•12/11/25, 10:57 AM

ideally before any other logic, to reduce the surface area for risk

Erisa•12/11/25, 10:57 AM

maybe that wouldnt have helped here? hard to tell without knowing more
but still good practice

EErisa regardless though, you should be validating the access jwt, thats also really im...

wawaOP•12/15/25, 5:17 PM

so anyone could put in a fake jwt token any cloudflare access wouldnt check it?

Erisa•12/15/25, 5:30 PM

if you validate jwt in your application then it prevents all kinds of bypasses

wawaOP•12/15/25, 5:33 PM

but does cloudflare not automatically check the jwt to see if someone put in something like kjasdiuasdadkjasdiuasdad?

Erisa•12/15/25, 6:17 PM

how would they do that if the request goes to your origin direct?

Nextjs app compromised even with cf acess enabld

Similar Threads

Similar Threads

Similar Threads