Threat Research · research.checkpoint.com

Check Point Details Five Cloudflare workerd Bugs Enabling Cross-Tenant Data Reads and Code Mode Sandbox Escape

Aug 6, 2026 · Original article ↗

Summary

Check Point researchers detail five workerd vulnerabilities, including a cross-tenant secret-read exploit and a Code Mode sandbox escape. Cloudflare says managed Workers are fixed; self-hosted deployments should update to workerd v1.20260619.1.

Key points

Researchers found five vulnerabilities in workerd’s native C++ code: two URLPattern out-of-bounds reads, two use-after-free bugs, and a SQL-authorizer bypass enabling crafted data to reach deserialization.
An URLPattern out-of-bounds read was used in a self-hosted proof of concept to read secrets from another Worker’s memory in a shared process.
A zlib use-after-free, triggered through attacker-controlled code following prompt injection, enabled a proof-of-concept escape from the Code Mode sandbox to native code execution.
The researchers verified both end-to-end exploits on self-hosted workerd and did not run the cross-tenant exploit against Cloudflare production.
Cloudflare rated the zlib and HTMLRewriter use-after-free vulnerabilities Critical; it confirmed the findings reproduce in production, with an exception for the original URLPattern implementation.
Cloudflare says managed Workers are fixed. Self-hosted workerd and Code Mode deployments should update to v1.20260619.1; no CVEs had been assigned at publication.

Article Details

Attack Vectors: A nested capture group in URLPattern can cause a group-count mismatch and an out-of-bounds read. The article reports the flaw in both implementations; the Ada-backed implementation was confirmed to trigger in Cloudflare production, while the original implementation did not.
A malicious Worker can use the URLPattern out-of-bounds read to read memory from another tenant in the shared process heap. The end-to-end cross-tenant secret-leak demonstration was verified on self-hosted workerd; the authors did not test that exploit on Cloudflare production.
In the node:zlib compatibility layer, write() can leave next_out pointing to a freed output buffer. Under the described conditions, handle.params() invokes deflateParams(), which can write through that stale pointer, creating a use-after-free.
The HTMLRewriter attributes iterator can retain a pointer to an attribute array that is freed when setAttribute() causes the array to reallocate; a subsequent iterator read accesses freed memory.
A KV SQL authorizer bypass allows a Worker to rename a permitted table to _cf_KV and supply crafted bytes that are later passed to workerd’s structured-clone deserializer. The researchers did not continue this issue into an exploit.
In the demonstrated Code Mode sandbox escape, prompt injection steers the model into writing attacker-controlled TypeScript that triggers the zlib use-after-free and achieves native code execution outside the V8 isolate. The exploit was verified on self-hosted workerd.
Defensive Notes: Cloudflare’s managed Workers environment was fixed in production. Self-hosted workerd and Code Mode deployments should update to v1.20260619.1.
Treat prompt injection that causes agent-generated code to run as a code-execution entry point in the threat model.
Review native glue layers that marshal pointers and lifetimes between JavaScript and C++; the article identifies these layers as a source of use-after-free and bounds-checking flaws.
Apply a threat model to native heap allocations outside the V8 cage and memory-protection keys; the article notes that the demonstrated primitives operated on the tcmalloc heap.