Security researchers have detailed a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment, achieving a data rate of up to 12 bits per second — 360 times faster than a similar attack demonstrated in 2021.
The end-to-end experiment was conducted with both attacker and victim Workers controlled by the researchers, with the JWT deliberately placed in the victim's memory. The paper states that no customer data was accessed.
Cloudflare said the vulnerability has already been mitigated in production following improvements to its Dynamic Process Isolation (DyPrIs), integration of the V8 Sandbox, and deployment of Memory Protection Keys (MPK)-based in-process isolation. The company added that it found no signs of active exploitation over the past three years.
The researchers said the production implementation of DyPrIs was insufficient, noting that Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process, relying on language-level isolation rather than strict process isolation to reduce startup latency. A memory read within a shared Worker process can lead to cross-tenant leakage.
The attack requires co-location of attacker and victim Workers in separate V8 isolates within the same Worker process. The attacker controls valid code in its own isolate; native code execution is outside the threat model, and the attack does not rely on a V8 software exploit or sandbox escape.
Cloudflare noted that Workers restrict local timing sources by freezing or coarsening timers during CPU execution and do not expose shared memory or multithreading to scripts. However, researchers found that WebSocket communications could serve as a remote timing source, and Durable Objects could keep a single Worker isolate alive for five to more than 20 hours.
DyPrIs isolates suspicious scripts into a separate process after an invocation finishes, but a long-lived Durable Object invocation could continue running before isolation took effect. Additionally, WebSocket-heavy input/output activity increased instruction translation lookaside buffer (iTLB) activity, reducing the normalized branch-misprediction signal used by DyPrIs below its detection threshold.
Cloudflare described the issue as a limitation in its DyPrIs implementation, while the paper said the two weaknesses reflected fundamental limitations of the detection approach rather than implementation oversights. The researchers argued that robust detection should occur during execution and use a signal that cannot be suppressed by I/O activity.
Production tests were conducted on Linux servers using AMD EPYC Zen 2 and Zen 3 processors, with measurements taken at night when CPU utilization was between 10% and 25% to achieve the best results. Higher system load reduced the leakage rate, though slower attacks remained feasible under high load. The leakage reached 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in the earlier attack.
The disclosure comes nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers at 120 bits per hour and introduced DyPrIs as a defense. That earlier paper reported a 0.61% false-positive rate and concluded DyPrIs statistically provided the same security guarantees as strict process isolation against the Spectre attacks evaluated at the time.
Cloudflare published additional Workers hardening measures in September 2025. The mitigations include improved DyPrIs for better detection, the V8 Sandbox to limit transient access to 64-bit pointers, and MPK-based in-process isolation that places Worker heaps behind hardware-enforced protection keys. Cloudflare said modern x64 systems leave about 12 keys available, and its design combines the keys with the V8 Sandbox and a rotating memory layout to prevent nearby sandboxes from sharing a key. The September 2025 description said random MPK assignment alone would trap about 92% of cross-isolate accesses because two isolates can receive the same key, and the stricter rotating layout removes that gap for the covered in-sandbox threat model.
Source: The Hackers News