A JWT Walks Out of a Cloudflare Worker at 12 Bits a Second
Researchers read a token out of a co-located Worker in Cloudflare's production fleet, 360 times faster than the 2021 demo that justified language-level isolation.
The Watch · Security desk
What happened
- Researchers disclosed a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.
- The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, with the JWT intentionally placed in the victim's memory; the paper stated that no customer data was accessed.
- Cloudflare said the attack has already been mitigated in production after it improved Dynamic Process Isolation (DyPrIs), integrated the V8 Sandbox, and deployed Memory Protection Keys (MPK)-based in-process isolation, adding that it found no indicators of active exploitation over the last three years.
- "We demonstrate that the production implementation of DyPrIs was insufficient," the researchers said in the paper.
- Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process, relying on language-level isolation instead of strict process isolation to reduce startup latency.
Why it matters
Researchers have disclosed a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in the production environment at up to 12 bits per second [1]. That is 360 times the rate of the 2021 attack that Cloudflare and TU Graz published alongside Dynamic Process Isolation (DyPrIs), the detection mechanism offered at the time as a statistical substitute for strict process isolation [1][18][19].
The design under test is the reason Workers start fast: code from multiple tenants runs in separate V8 isolates inside the same operating-system process, with language-level isolation standing in for a process boundary [6]. Cloudflare's own framing is that a memory read inside a shared Worker process can lead to cross-tenant leakage, and the attack requires attacker and victim to land in separate isolates in the same process [7]. Nothing exotic is needed above that. The attacker runs valid code in its own isolate; native code execution is outside the threat model, and the attack does not depend on a V8 bug or a sandbox escape [8].
Two supposed obstacles were worked around rather than broken. Workers freeze or coarsen timers during CPU execution and expose neither shared memory nor multithreading [9], so the researchers used WebSocket communications as a remote timing source, and Durable Objects to keep a single isolate alive for five to more than 20 hours [10]. DyPrIs moves suspicious scripts into their own process after an invocation finishes, and a long-lived Durable Object invocation can simply keep running before that happens [11]. Separately, WebSocket-heavy I/O raised instruction TLB activity, pushing the normalized branch-misprediction signal DyPrIs relies on below its detection threshold [12].
That distinction matters more than the leak rate. Cloudflare called the problem a limitation of its DyPrIs implementation; the paper says the two weaknesses are fundamental limits of the detection approach, not oversights, and argues robust detection has to happen during execution using a signal that I/O activity cannot suppress [23][24]. The researchers' summary is blunt: "We demonstrate that the production implementation of DyPrIs was insufficient" [5].
The numbers deserve context. Tests ran on Linux servers with AMD EPYC Zen 2 and Zen 3 processors, and the researchers deliberately measured at night, when CPU utilization sat between 10% and 25%, to get the best possible result [16]. Higher load cut the leakage rate, though slower attacks stayed feasible [17]. The headline figure is up to 12 bits per second at 99.16% accuracy, against 2 bits per minute in 2021 [2]. In per-hour terms that is roughly 43,200 bits versus 120 [15]. The experiment was end-to-end but self-contained: both the attacker and victim Workers belonged to the researchers, the JWT was planted in the victim's memory, and the paper states no customer data was accessed [3].
Cloudflare says the attack is already mitigated in production and that it found no indicators of active exploitation over the last three years [4]. The fixes, published as Workers hardening in September 2025, are improved DyPrIs detection, the V8 Sandbox to limit transient access to 64-bit pointers, and MPK-based in-process isolation putting Worker heaps behind hardware-enforced protection keys [4][13][14]. Cloudflare says modern x64 systems leave about 12 keys available, so it combines them with the V8 Sandbox and a rotating memory layout to stop neighbouring sandboxes sharing a key [20]. By its own September 2025 accounting, random key assignment alone would trap about 92% of cross-isolate accesses, leaving roughly 8% uncovered, which is what the rotating layout is there to close [21][22].
Worth watching: whether the 2021 conclusion that DyPrIs matched process isolation statistically [19] gets restated for the improved version, and on what evidence; and whether the key-count ceiling of about 12 [20] constrains density as Cloudflare packs more tenants per machine.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption45
- Hype gap+15
- Incentives55
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Researchers disclosed a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.
- [2]
The paper reported leakage of up to 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in the earlier attack.
- [3]
The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, with the JWT intentionally placed in the victim's memory; the paper stated that no customer data was accessed.
- [4]
Cloudflare said the attack has already been mitigated in production after it improved Dynamic Process Isolation (DyPrIs), integrated the V8 Sandbox, and deployed Memory Protection Keys (MPK)-based in-process isolation, adding that it found no indicators of active exploitation over the last three years.
- [5]
"We demonstrate that the production implementation of DyPrIs was insufficient," the researchers said in the paper.
- [6]
Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process, relying on language-level isolation instead of strict process isolation to reduce startup latency.
- [7]
A memory read within a shared Worker process can lead to cross-tenant leakage, according to Cloudflare, and the attack requires the attacker and victim Workers to be co-located in separate V8 isolates within the same Worker process.
- [8]
The attacker controls valid code in its own isolate; native code execution is outside the threat model, and the attack does not depend on a V8 software exploit or sandbox escape.
- [9]
Cloudflare said Workers restrict local timing sources by freezing or coarsening timers during CPU execution, and do not expose shared memory or multithreading to Worker scripts.
- [10]
The researchers found that WebSocket communications could provide a remote timing source, while Durable Objects could keep a single Worker isolate alive for five to more than 20 hours.
- [11]
DyPrIs isolates suspicious scripts into a separate process after an invocation finishes, and the researchers found that a long-lived Durable Object invocation could continue running before the isolation took place.
- [12]
The researchers found that WebSocket-heavy input/output activity increased instruction translation lookaside buffer (iTLB) activity, reducing the normalized branch-misprediction signal used by DyPrIs below its detection threshold.
- [13]
Cloudflare published additional Workers hardening measures in September 2025.
- [14]
The mitigations listed are improved DyPrIs detection capabilities, the V8 Sandbox limiting transient access to 64-bit pointers, and MPK-based in-process isolation placing Worker heaps behind hardware-enforced protection keys.
- [15]
12 bits per second is about 43,200 bits per hour, against the 120 bits per hour reported in the 2021 attack, a factor of 360.
- [16]
The paper said production tests were conducted on Linux servers using AMD EPYC Zen 2 and Zen 3 processors, with the researchers intentionally running measurements at night, when CPU utilization was between 10% and 25%, to observe the best possible results.
- [17]
The researchers said higher system load reduced the leakage rate, although slower attacks remained feasible under high load.
- [18]
The disclosure comes nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers at 120 bits per hour and introducing DyPrIs as a defense.
- [19]
The earlier paper reported a 0.61% false-positive rate and concluded that DyPrIs statistically provided the same security guarantees as strict process isolation against the Spectre attacks evaluated at the time.
- [20]
Cloudflare said modern x64 systems leave about 12 protection keys available for this purpose, and its design combines the keys with the V8 Sandbox and a rotating memory layout to prevent nearby sandboxes from sharing a key.
- [21]
Cloudflare's September 2025 description said that random MPK assignment alone would trap about 92% of cross-isolate accesses because two isolates can receive the same key, and that the stricter rotating layout is used to remove that gap.
- [22]
If random MPK assignment alone traps about 92% of cross-isolate accesses, roughly 8% would not be trapped.
- [23]
Cloudflare described the issue as a limitation in its DyPrIs implementation, while the paper said the two weaknesses reflected fundamental limitations of the detection approach rather than implementation oversights.
- [24]
The researchers said robust detection should take place during execution and use a signal that cannot be suppressed by I/O activity.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comResearchers demonstrate faster remote Spectre attack against Cloudflare Workers
1 article · August 20, 2026
- thehackernews.comCloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
2 articles · August 20, 2026
Topics and entities
Topics
- Transient execution attacks
- Serverless and edge computing
- Multi-Tenant Isolation
Entities
- Spectre
- V8
- Cloudflare
- University of Edinburgh
- Dynamic Process Isolation (DyPrIs)
- Cloudflare Workers
- JSON Web Token
- AMD EPYC (Zen 2 / Zen 3)
- Memory Protection Keys (MPK)