Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.
The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, with the JWT intentionally placed in the victim’s memory. The research paper stated that no customer data was accessed.
Cloudflare said the attack has already been mitigated in production after it improved Dynamic Process Isolation (DyPrIs), integrated the V8 Sandbox, and deployed Memory Protection Keys (MPK)-based in-process isolation, adding that it found no indicators of active exploitation over the last three years.
“We demonstrate that the production implementation of DyPrIs was insufficient,” the researchers said in the paper.
Cloudflare Workers runs code from multiple tenants in separate V8 isolates within the same operating-system process, relying on language-level isolation instead of strict process isolation to reduce startup latency.
A memory read within a shared Worker process can lead to cross-tenant leakage, according to Cloudflare. The attack requires the attacker and victim Workers to be co-located in separate V8 isolates within the same Worker process.
The attacker controls valid code in its own isolate. Native code execution is outside the threat model, and the attack does not depend on a V8 software exploit or sandbox escape.
Cloudflare said Workers restrict local timing sources by freezing or coarsening timers during CPU execution, and do not expose shared memory or multithreading to Worker scripts.
The researchers found that WebSocket communications could provide a remote timing source, while Durable Objects could keep a single Worker isolate alive for five to more than 20 hours.
DyPrIs isolates suspicious scripts into a separate process after an invocation finishes, and the researchers found that a long-lived Durable Object invocation could continue running before the isolation took place.
The researchers also found that WebSocket-heavy input/output (I/O) activity increased instruction translation lookaside buffer (iTLB) activity, reducing the normalized branch-misprediction signal used by DyPrIs below its detection threshold.
Cloudflare described the issue as a limitation in its DyPrIs implementation, while the paper said the two weaknesses reflected fundamental limitations of the detection approach rather than implementation oversights. The researchers said robust detection should take place during execution and use a signal that cannot be suppressed by I/O activity.
The paper said the production tests were conducted on Linux servers using AMD EPYC Zen 2 and Zen 3 processors, with the researchers intentionally running measurements at night, when CPU utilization was between 10% and 25%, to observe the best possible results.
The researchers said higher system load reduced the leakage rate, although slower attacks remained feasible under high load.
The paper reported leakage of up to 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in the earlier attack.
The disclosure comes nearly five years after Cloudflare and TU Graz published research demonstrating a remote Spectre attack against Workers at 120 bits per hour and introducing DyPrIs as a defense.
The earlier paper reported a 0.61% false-positive rate and concluded that DyPrIs statistically provided the same security guarantees as strict process isolation against the Spectre attacks evaluated at the time.
Cloudflare published additional Workers hardening measures in September 2025. The mitigations deployed by Cloudflare are listed below –
- Improved DyPrIs improves the detection capabilities of the existing isolation mechanism.
- V8 Sandbox limits transient access to 64-bit pointers.
- MPK-based in-process isolation places Worker heaps behind hardware-enforced protection keys. Cloudflare said modern x64 systems leave about 12 keys available for this purpose, and its design combines the keys with the V8 Sandbox and a rotating memory layout to prevent nearby sandboxes from sharing a key.
Cloudflare’s September 2025 description said that random MPK assignment alone would trap about 92% of cross-isolate accesses because two isolates can receive the same key, and that the stricter rotating layout is used to remove that gap for the covered in-sandbox threat model.
