Cloudflare Workers Hit by Sophisticated Spectre Attack, Leaking JWTs at Elevated Rates
San Francisco, CA – August 19, 2026 – Cybersecurity researchers have unveiled details of a highly potent remote Spectre attack against Cloudflare Workers, demonstrating the ability to extract JSON Web Tokens (JWTs) from co-located Worker instances in a production environment at a rate significantly higher than previously observed. The breakthrough attack, capable of leaking data at up to 12 bits per second, represents a 360-fold increase in efficacy compared to a similar demonstration in 2021.
The end-to-end experiment involved a controlled setup where researchers deployed both an "attacker Worker" and a "victim Worker" on Cloudflare’s infrastructure. A JWT was intentionally placed within the victim’s memory to simulate a real-world data target. Crucially, the researchers confirmed that no actual customer data was compromised during these tests.
Cloudflare has responded to the findings, stating that the vulnerabilities exploited by this sophisticated attack have already been mitigated in their production environment. The company attributed these improvements to several key enhancements: a refined Dynamic Process Isolation (DyPrIs) system, the integration of the V8 Sandbox, and the deployment of Memory Protection Keys (MPK)-based in-process isolation. Cloudflare also emphasized that an extensive review over the past three years yielded no indicators of active exploitation of these specific vulnerabilities.
However, the researchers, in their paper, stated, "We demonstrate that the production implementation of DyPrIs was insufficient," highlighting fundamental limitations rather than mere implementation oversights.
Understanding the Attack Vector
Cloudflare Workers operate by running code from multiple tenants within separate V8 isolates, all co-existing within the same operating-system process. This architectural choice, which prioritizes reduced startup latency, relies on language-level isolation rather than stricter process isolation. As Cloudflare itself acknowledges, a memory read within such a shared Worker process can, under specific circumstances, lead to cross-tenant data leakage.
The newly disclosed Spectre attack specifically targets this shared-process architecture. For the attack to succeed, both the attacker and victim Workers must be co-located within separate V8 isolates on the same Worker process. The attacker’s control is limited to valid code within its own isolate, and the attack does not rely on V8 software exploits or sandbox escapes, nor does it involve native code execution – factors outside the current threat model.
Overcoming Existing Mitigations
Cloudflare had previously implemented measures to thwart such attacks, including restricting local timing sources by freezing or coarsening timers during CPU execution and preventing Worker scripts from directly accessing shared memory or multithreading capabilities.
However, the researchers cleverly circumvented these safeguards:
- Remote Timing Source: They discovered that WebSocket communications could be leveraged to provide a remote timing source, a crucial element for timing-based side-channel attacks like Spectre.
- Persistent Isolates: The researchers found that "Durable Objects" – a Cloudflare feature – could keep a single Worker isolate alive for extended periods (five to over 20 hours). This prolonged lifespan allowed long-running Durable Object invocations to persist before DyPrIs could effectively isolate suspicious scripts into separate processes.
- Evading DyPrIs Detection: The team also identified that intense WebSocket-heavy input/output (I/O) activity significantly increased instruction translation lookaside buffer (iTLB) activity. This, in turn, reduced the normalized branch-misprediction signal used by DyPrIs below its detection threshold, allowing the attack to proceed undetected.
While Cloudflare characterized these findings as "limitations in its DyPrIs implementation," the researchers argued that the two identified weaknesses reflected fundamental limitations in the detection approach itself, rather than mere oversights in implementation. They advocate for robust detection mechanisms that operate during execution and utilize signals impervious to suppression by I/O activity.
Production Environment Testing and Performance
The production tests were conducted on Linux servers utilizing AMD EPYC Zen 2 and Zen 3 processors. To achieve optimal results, researchers intentionally ran measurements during periods of low CPU utilization (10% to 25%). They noted that while higher system loads reduced the leakage rate, slower attacks remained feasible even under significant strain.
The paper reports a remarkable leakage rate of up to 12 bits per second with an impressive 99.16% accuracy, a stark contrast to the 2 bits per minute achieved in the earlier 2021 attack.
A History of Spectre Research and Evolution of Defenses
This disclosure arrives nearly five years after Cloudflare, in collaboration with TU Graz, first published research demonstrating a remote Spectre attack against Workers in 2021, at a rate of 120 bits per hour. That earlier paper also introduced DyPrIs as a primary defense mechanism, reporting a mere 0.61% false-positive rate and concluding that DyPrIs provided statistically equivalent security guarantees to strict process isolation against the Spectre attacks evaluated at the time. The current findings demonstrate the ongoing cat-and-mouse game between attackers and defenders in the complex realm of cloud security.
Cloudflare’s Enhanced Security Measures
In response to evolving threats, Cloudflare implemented additional Workers hardening measures in September 2025. These include:
- Improved DyPrIs: Enhancing the detection capabilities of the existing isolation mechanism.
- V8 Sandbox: Limiting transient access to 64-bit pointers.
- MPK-based in-process isolation: Placing Worker heaps behind hardware-enforced protection keys. Cloudflare notes that modern x64 systems typically offer around 12 keys for this purpose. Their design cleverly combines these keys with the V8 Sandbox and a rotating memory layout to prevent nearby sandboxes from sharing a key, further bolstering isolation.
Cloudflare’s September 2025 description clarified that while random MPK assignment alone would block approximately 92% of cross-isolate accesses (due to the possibility of two isolates receiving the same key), the stricter rotating layout is employed to eliminate this gap for the covered in-sandbox threat model, providing a more robust defense against sophisticated side-channel attacks.
