Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

KUALA LUMPUR, 20 AUGUST 2026 —

Cloudflare Workers Spectre Attack Exposes JWT Data at 12 Bits/Second, Researchers Say

Cloudflare confirmed that the attack vector has already been mitigated in production through enhancements to Dynamic Process Isolation (DyPrIs), integration of the V8 Sandbox, and deployment of Memory Protection Keys (MPK)-based in-process isolation. The company stated it has found no indicators of active exploitation over the past three years. “We demonstrate that the production implementation of DyPrIs was insufficient,” the researchers wrote in their paper.

Cloudflare Workers executes code from multiple tenants within separate V8 isolates in the same operating-system process, relying on language-level isolation rather than strict process isolation to reduce startup latency. This architecture allows memory reads within a shared Worker process to potentially lead to cross-tenant data leakage, Cloudflare noted. The attack requires both attacker and victim Workers to be co-located in separate V8 isolates within the same Worker process. The attacker controls valid code in its own isolate, and the threat model excludes native code execution, V8 software exploits, or sandbox escapes.

Cloudflare said Workers restrict local timing sources by freezing or coarsening timers during CPU execution and do not expose shared memory or multithreading to Worker scripts. However, the researchers identified WebSocket communications as a potential remote timing source, while Durable Objects could maintain a single Worker isolate for durations ranging from five to over 20 hours.

DyPrIs isolates suspicious scripts into a separate process after an invocation finishes. The researchers found that a long-lived Durable Object invocation could continue running before isolation occurred. They also observed that WebSocket-heavy input/output (I/O) activity increased instruction translation lookaside buffer (iTLB) activity, reducing the normalized branch-misprediction signal used by DyPrIs below its detection threshold.

Cloudflare described the issue as a limitation in its DyPrIs implementation, while the research paper characterized the two weaknesses as fundamental limitations of the detection approach rather than mere implementation oversights. The researchers argued that detection should occur during execution and use a signal that cannot be suppressed by I/O activity.

The production tests were conducted on Linux servers using AMD EPYC Zen 2 and Zen 3 processors, with measurements intentionally taken at night when CPU utilization ranged between 10% and 25% to achieve optimal results. The researchers noted that higher system load reduced the leakage rate, though slower attacks remained feasible even under high load.

The paper reported leakage of up to 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in the earlier 2021 attack. The disclosure follows nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers at 120 bits per hour and introducing DyPrIs as a defense. The earlier study reported a 0.61% false-positive rate and concluded that DyPrIs provided statistically equivalent security guarantees to strict process isolation against the evaluated Spectre attacks at the time.

Cloudflare announced additional hardening measures for Workers in September 2025. According to the company’s description, random MPK assignment alone would block approximately 92% of cross-isolate accesses due to the possibility of two isolates receiving the same key. A stricter rotating layout was implemented to close this gap within the covered in-sandbox threat model.

The findings underscore ongoing challenges in mitigating side-channel attacks in shared cloud environments, particularly in serverless platforms where performance and isolation must be carefully balanced. While Cloudflare has deployed technical mitigations, the research highlights the need for continuous refinement of security mechanisms as attack techniques evolve.

Industry observers note that such disclosures often prompt broader reassessment of isolation strategies across cloud providers. The incident also raises questions about the effectiveness of current detection thresholds in high-I/O workloads, where timing channels may remain exploitable despite mitigation efforts.

For Malaysian enterprises leveraging serverless architectures, the disclosure serves as a reminder to review isolation policies and timing-channel defenses. While Cloudflare has addressed the specific vulnerability, the broader lesson centers on the importance of layered security and regular reassessment of threat models in dynamic cloud environments.

Details regarding regional adoption of similar mitigations or customer advisories from other cloud providers in Malaysia were not available at the time of reporting.

Related: Cloudflare · Kuala Lumpur