Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
- ID
- 15795
- Status
- summarized
- Published
- 20 Aug 2026, 3:02 AM
- Fetched
- 20 Aug 2026, 5:05 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 20 Aug 2026, 5:06 AM
- Tags
- Audience
- developerssaas_founders
What happened
Security researchers demonstrated a remote Spectre attack on Cloudflare Workers that leaked a JWT from a co-located Worker at 12 bits/second, 360x faster than a 2021 proof-of-concept. The attack exploited V8 isolate co-location within the same OS process, using WebSocket traffic as a remote timing source and Durable Objects to keep an isolate alive for 5-20+ hours, bypassing Cloudflare's Dynamic Process Isolation before it could trigger. Cloudflare reports the attack is now mitigated via V8 Sandbox integration and Memory Protection Keys, with no evidence of active exploitation in three years.
Why it matters
If you ship on Cloudflare Workers with Durable Objects or WebSockets, this reveals that language-level V8 isolation is not equivalent to process isolation, and that long-lived Durable Object invocations created a window where DyPrIS never fired. The mitigations are deployed, but the architectural tradeoff—shared-process multi-tenancy for low startup latency—remains inherent to the platform. Review whether sensitive tokens like JWTs belong in Worker memory at all, and consider whether your threat model accounts for co-tenant side-channel risk on edge platforms that use isolate-based isolation rather than full process boundaries.
Discussion angle
The Durable Objects bypass is the most interesting part: a feature designed for long-lived state inadvertently defeated the isolation mitigation. Discuss whether edge platforms that prioritize low latency via shared-process multi-tenancy can ever fully close side-channel gaps, and what this means for Malaysian startups building auth-sensitive workloads on Workers versus traditional container-based cloud.