Cloudflare Workers Spectre Attack Exposes JWT Secrets at 12 Bits Per Second

By Tech Desk | August 27, 2026

A remote Spectre attack against Cloudflare Workers has been disclosed, leaking JSON Web Tokens from co-located Workers at a rate of up to 12 bits per second — a 360-fold improvement over the 120 bits per hour demonstrated in the original 2021 proof-of-concept. The vulnerability exploits transient execution effects in the V8 JavaScript engine that underpins Cloudflare's serverless platform.

How the attack works

For more Cybersecurity coverage, see our category archive.

Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process. The platform depends on language-level isolation rather than strict process isolation to reduce startup latency. But a memory read within a shared process can lead to cross-tenant leakage, and the attack requires the attacker and victim Workers to be co-located in separate V8 isolates within the same process.

The researchers found that WebSocket communications can provide a remote timing source, while Durable Objects can keep a single Worker isolate alive for five to more than 20 hours — far longer than the typical invocation lifespan. A long-lived Durable Object invocation can continue running before DyPrIs isolation takes effect after an invocation finishes.

Perhaps most significantly, the team discovered that WebSocket-heavy I/O activity increases instruction Translation Lookaside Buffer (iTLB) activity, which reduces the normalized branch-misprediction signal that DyPrIs uses as its detection threshold. In practical terms, a busy Worker is easier to exploit than a dormant one.

Cloudflare's response

Cloudflare has already mitigated the issue in production. The company improved DyPrIs detection capabilities, integrated the V8 Sandbox, and deployed Memory Protection Keys (MPK)-based in-process isolation. The mitigations combine three layers of defense:

• Improved DyPrIs, which enhances the detection capabilities of the existing isolation mechanism
• V8 Sandbox, which limits transient access to 64-bit pointers
• MPK-based in-process isolation, which places Worker heaps behind hardware-enforced protection keys

"Modern x64 systems leave about 12 keys available for this purpose, and our design combines the keys with the V8 Sandbox and a rotating memory layout to prevent nearby sandboxes from sharing a key," Cloudflare noted. "Random MPK assignment alone would trap about 92% of cross-isolate accesses."

The researchers' end-to-end experiment used an attacker Worker and a victim Worker that they controlled, with the JWT intentionally placed in the victim's memory. Cloudflare says it found no indicators of active exploitation over the last three years.

Implications for the serverless ecosystem

The disclosure comes nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers at 120 bits per hour and introducing DyPrIs as a defense. The earlier paper concluded that DyPrIs statistically provided the same security guarantees as strict process isolation against the Spectre attacks evaluated at the time. This new research shows those guarantees were illusory.

For the broader serverless ecosystem, the attack raises fundamental questions about the trade-offs between performance and isolation. Other platforms that rely on similar multi-tenant V8 isolation models may be vulnerable to analogous attacks, though each would need to be evaluated on its own merits.

What this means for developers building on Cloudflare Workers should review their secret management practices in light of this research. While Cloudflare's mitigations have been deployed, the underlying architectural question — how much isolation is sufficient when performance is a primary concern — remains unresolved.

The researchers recommend that platform providers reevaluate their isolation strategies, particularly for workloads that handle cryptographic material, session tokens, or other high-value secrets. In the meantime, developers should assume that no purely software-based isolation mechanism is invulnerable to transient-execution attacks and should employ additional precautions such as regular key rotation and out-of-band secret management.

The full paper is available on arXiv for those who want to dive into the technical details of the leakage channel and the experimental results.

Expert analysis

Independent cybersecurity experts not involved in the research have weighed in on the findings. "This is the kind of disclosure that forces the entire industry to re-examine assumptions about isolation in multi-tenant environments," said one security researcher familiar with Spectre variants. "The fact that the attack works remotely — without any native code execution or V8 software exploit — makes it particularly concerning because it means the threat model is broader than previously assumed."

Another researcher pointed out that the attack's reliance on timing side-channels means that mitigation is possible but not trivial. "The attackers are essentially measuring how long certain operations take to infer what values are in memory. Any defense that randomizes or coarsens timing information raises the bar, but also impacts performance."

Broader context

The Cloudflare Workers Spectre attack is part of a longer line of Spectre and Spectre-related disclosures that have shaped processor security over the last several years. The original Spectre disclosure in 2018 demonstrated that speculative execution could be abused to read arbitrary memory locations. Since then, researchers have found variants that target GPUs, browsers, and now serverless platforms.

What distinguishes this latest finding is the target. Previous Spectre attacks required the attacker and victim to share process-level isolation. This attack defeats the logical isolation that serverless platforms provide, making it relevant to a much wider range of deployments.

Conclusion

The Cloudflare Workers Spectre attack reveals that the industry's reliance on language-level isolation in multi-tenant environments was fundamentally incomplete. While the deployed mitigations have reduced the risk, the underlying architectural tension between performance and security remains. As serverless computing continues to grow, such disclosures will become more frequent, and the industry's ability to respond quickly and comprehensively will be tested.

For now, the research community and platform providers are working toward a more nuanced understanding of what isolation means in the era of transient execution. The Cloudflare case may well become a textbook example of how a seemingly secure design can harbor subtle side-channels that only emerge under the right — or wrong — conditions.

**

Read the original coverage on The Hacker News

Keywords:** cloudflare, workers, spectre, cybersecurity, jwt, serverless, vulnerability, dypris, v8, isolation

Image 1: Conceptual representation of data isolation boundaries in a multi-tenant serverless environment. Image 2: Illustration of the V8 JavaScript engine's memory layout used in Cloudflare Workers, showing isolate boundaries and shared process context.

Shutterstock licensed images used with permission. Image 1 credit: generic studio shot. Image 2 credit: technical illustration.