Cybersecurity experts have unveiled a Spectre-based attack targeting Cloudflare Workers, leading to the leakage of JSON Web Tokens (JWTs) from co-located Workers at a rate of up to 12 bits per second. This rate is significantly faster than the 2021 attack, which leaked data at 2 bits per minute. In their controlled experiment, researchers used an attacker Worker and a victim Worker with a JWT intentionally stored in the victim's memory. Importantly, no customer data was compromised during these tests. Cloudflare has addressed this vulnerability by enhancing its Dynamic Process Isolation (DyPrIs), introducing V8 Sandbox integration, and implementing Memory Protection Keys (MPK) for in-process isolation. The company has stated that no signs of active exploitation have been detected in the past three years.
Cloudflare Workers hosts code from various users in separate V8 isolates within the same operating system process, opting for language-level isolation over strict process isolation to minimize startup delays. However, this configuration allows for potential cross-tenant data leakage if a memory read occurs within a shared Worker process. The attack scenario necessitates that both attacker and victim Workers reside in separate V8 isolates but within the same Worker process. Crucially, the attack does not involve a V8 software exploit or sandbox escape.
Cloudflare restricts local timing sources by manipulating timers during CPU execution and does not provide shared memory or multithreading to Worker scripts. Nevertheless, researchers identified that WebSocket communications could serve as a remote timing source, while Durable Objects could extend a single Worker isolate's lifespan significantly. The researchers also noted that WebSocket-heavy input/output (I/O) activity could diminish the detection capabilities of DyPrIs by reducing the normalized branch-misprediction signal.
Cloudflare acknowledged a limitation in its DyPrIs implementation, but researchers argue these issues stem from fundamental detection limitations rather than implementation flaws. They advocate for real-time detection using unsuppressable signals during execution. The tests were conducted on Linux servers with AMD EPYC Zen 2 and Zen 3 processors. Higher CPU loads reduced the leakage rate, but slower attacks remained viable during heavy usage. This disclosure follows nearly five years after initial research by Cloudflare and TU Graz, which introduced DyPrIs as a defense against Spectre attacks. Cloudflare continues to harden its Workers platform, implementing additional measures as of September 2025 to further secure against such vulnerabilities.