`@cloudflare/next-on-pages` is a CLI tool that you can use to build and develop [Next.js](https://nextjs.org/) applications so that they can run on the [Cloudflare Pages](https://pages.cloudflare.com/) platform (and integrate with Cloudflare's various oth
12%
Total Score
critical
Unfit to use: the package is deprecated, its repository is archived, and it has had no commits in the last three months.
The entire package is deprecated, with the registry directing users to the OpenNext adapter. This is a direct warning against starting a new dependency on this release line.
Although the package has 440 historical releases and previously released frequently, it had no releases in the last 12 months; the old release cadence does not offset the current stoppage.
The repository recorded zero commits and zero active maintainers in the last three months. The archived state makes this lack of activity a strong abandonment signal.
The linked Cloudflare repository is archived, which indicates the source project is no longer an actively maintained target for future fixes.
All seven workflows were analyzed, with no untrusted checkout or script-injection findings, but all 13 action references are unpinned and a high-confidence unpinned container image was found. The audit also identified trusted-publishing usage, leaving release-workflow hygiene concerns.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2024-10175 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cloudflare/next-on-pages is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.4.0 - 1.12.0. | 1.4.0 - 1.12.0 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
acorn Version ^8.8.0 | — | — |
chalk Version ^5.2.0 | — | — |
cookie Version ^0.5.0 | — | — |
semver Version ^7.5.2 | — | — |
esbuild Version ^0.15.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.