Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

Description

An Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK.

Recommendation

Update the agents package to the latest compatible version. Followings are version details:

Affected version(s): < 0.3.7
Patched version(s): 0.3.7

References

GHSA-r7x9-8ph7-w8cg
CVE-2026-1664
CWE-639
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing and gives you actionable findings to investigate.

Start a free scan

Related Issues

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) - CVE-2024-22206
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 03, 2026