Critical Vulnerabilities in Cloudflare's workerd Runtime Expose Workers and Code Mode to Sandbox Escapes and Data Exposure
Check Point Research has discovered five critical vulnerabilities in Cloudflare's workerd runtime, impacting both Cloudflare Workers and Code Mode, with potential for sandbox escapes and cross-tenant data theft.
Check Point Research has uncovered a significant security flaw impacting Cloudflare's workerd runtime, the open-source engine powering both Cloudflare Workers and the AI-focused Code Mode. The investigation revealed five vulnerabilities within workerd, two of which have been classified as critical by Cloudflare. These flaws create a substantial risk, as workerd is fundamental to isolating untrusted code, a core function for both multi-tenant Workers environments and the sandboxed execution of AI-generated code in Code Mode.
The implications of these vulnerabilities are far-reaching, given Cloudflare's extensive reach. Cloudflare Workers are utilized by millions of developers, process millions of requests per second, and handle over 10% of all traffic on Cloudflare's network. The identified vulnerabilities could allow for sandbox escapes and the exposure of sensitive data across different tenants, directly undermining the isolation guarantees provided by the workerd runtime.
Two specific critical vulnerabilities stand out. The first, an out-of-bounds read in the URLPattern component, enables a malicious Worker to access and exfiltrate secrets belonging to another tenant by exploiting shared memory within the process. This represents a severe breach of tenant isolation. The second critical flaw is a use-after-free vulnerability within the node:zlib module. This bug can be leveraged to achieve native code execution on the host system, effectively breaking out of the intended sandbox environment.
Cloudflare Code Mode, designed to allow AI models to write and execute TypeScript code against available tools, relies heavily on workerd for its security. The research demonstrated that starting from a prompt injection attack, the use-after-free vulnerability in node:zlib could be exploited to escape the Code Mode sandbox and execute arbitrary native code on the underlying host.
Cloudflare has responded swiftly to these findings. Their managed Workers environment has already been patched in production. However, organizations self-hosting workerd or using Code Mode are urged to update their deployments to version v1.20260619.1 to mitigate these risks. Check Point Research has made proof-of-concept code publicly available, which was presented at Black Hat USA 2026, underscoring the immediate need for these updates.
The workerd runtime, which was only open-sourced in September 2022 after years of being a closed-source component of Cloudflare Workers, operates by isolating untrusted code using V8 isolates. While efficient for edge computing, this in-process isolation model relies on a software boundary, making it susceptible to memory corruption bugs that can lead to escapes. The research highlights the inherent risks of such ambitious security architectures when subjected to deep scrutiny.
This discovery underscores the growing security challenges associated with running untrusted code, particularly AI-generated code, in shared environments. As platforms like Cloudflare Workers and Code Mode become more prevalent, the integrity of their underlying runtimes is paramount. The vulnerabilities found in workerd serve as a stark reminder that even sophisticated isolation mechanisms require continuous auditing and patching to stay ahead of evolving threats.