Cloudflare Workers Spectre Attack Leaks JWT From Co
Researchers demonstrated a remote Spectre attack leaking a JWT between co-located Cloudflare Workers at 12 bits per second, 360x the 2021 rate.
Security researchers showed a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker at up to 12 bits per second with 99.16% accuracy, 360 times the 2021 demonstration rate. The attack exploited weaknesses in DyPrIs dynamic process isolation, where long-lived Durable Object invocations could run before isolation and WebSocket-heavy I/O suppressed the branch-misprediction signal. Cloudflare deployed improved DyPrIs, the V8 Sandbox, and MPK-based in-process isolation, and found no indicators of active exploitation over three years.
- Remote Spectre leak reached 12 bits per second at 99.16% accuracy
- DyPrIs detection had fundamental limits against long-lived and I/O-heavy invocations
- Mitigations include V8 Sandbox and MPK-based in-process isolation
- No customer data accessed and no signs of exploitation in three years
- Vendors
- Cloudflare
- Products
- Cloudflare Workers
From the original article
3 min read at thehackernews.com
Swati Khandelwal Aug 19, 2026 Cloud Security / Vulnerability Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.