Check Point Research has identified five memory-corruption vulnerabilities within `workerd`, the open-source runtime environment underpinning both Cloudflare Code Mode and Cloudflare Workers. Two of these vulnerabilities were rated critical by Cloudflare. The flaws could enable sandbox escapes in Code Mode and cross-tenant data exposure in Cloudflare Workers, a platform utilized by millions of developers and handling a significant portion of Cloudflare's network traffic.
Cloudflare has confirmed that its managed Workers environment has been patched in production. Users with self-hosted `workerd` or Code Mode deployments are advised to update to version `v1.20260619.1`. Proof-of-concept code demonstrating the vulnerabilities was released by Check Point Research during its Black Hat USA 2026 presentation.
The research focused on `workerd` because it serves as the in-process sandbox that isolates untrusted code, relying entirely on V8 for this isolation. The vulnerabilities were found in `workerd`'s native C++ code, which acts as the intermediary between JavaScript and the runtime. Two primary attack scenarios were developed: a cross-tenant heap swipe and a Code Mode sandbox escape.
The cross-tenant heap swipe exploits an out-of-bounds read vulnerability in `URLPattern`. This allows a malicious Worker to access the shared process heap and potentially extract sensitive data belonging to another tenant. The Code Mode sandbox escape, initiated through a prompt injection, leverages a use-after-free vulnerability in `node:zlib` to break out of the sandbox and execute native code on the host system.
Code Mode is Cloudflare's approach to Large Language Model (LLM) tool use, where AI models write TypeScript code against a defined API of tools, rather than making sequential tool calls. This generated code is executed within `workerd`. Cloudflare Workers, launched in 2017, is a serverless platform that runs customer code at the network edge. To achieve low latency and cost, Cloudflare packs multiple customer Workers into the same processes, relying on V8 isolates for isolation. `workerd`, which was open-sourced in September 2022, implements this isolation model.
Check Point Research targeted `workerd` due to its design as an in-process sandbox, which inherently carries higher risk compared to OS-level isolation methods like containers or virtual machines. Despite its critical role, `workerd` had received minimal public security scrutiny. The runtime also presents a large attack surface, implementing numerous Web/Node APIs in C++ that are accessible from untrusted JavaScript. The widespread deployment of Cloudflare Workers meant that any vulnerability in `workerd` would have a broad impact beyond experimental AI features.
Cloudflare employs several defense mechanisms to mitigate the risk of V8 vulnerabilities, including "the cage," which confines JavaScript-reachable objects to prevent corruption from spreading. However, the discovered vulnerabilities demonstrate that even with these defenses, the shared memory space within `workerd` can be exploited if the software boundary between isolates is compromised.
