Cloudflare researchers reassessed remote Spectre attacks against its Workers platform, uncovering a limitation in the original Dynamic Process Isolation (DyPrIs) defense. Using new attack primitives - a speculative type-confusion gadget, tree-based PLRU cache amplification, remote WebSocket timers, and Durable Objects to keep isolates alive - they achieved reliable cross-tenant memory leakage of up to 12 bit/s at over 99% accuracy in production, demonstrated end-to-end by exfiltrating a JWT token bit by bit from a co-located victim Worker. No evidence of active exploitation in the wild was found over the past three years, and Cloudflare has since hardened defenses with the V8 Sandbox, hardware-assisted in-process isolation via Memory Protection Keys (deployed September 2025), and an improved DyPrIs that accounts for long-lived and I/O-heavy workloads. A full academic paper detailing the research, covering work from 2024 and early 2025, has been published alongside the writeup.
Table of contents
Copy link Cloudflare Workers security modelCopy link SpectreCopy link Attack primitivesCopy link Why was this not detected?Copy link What we changedCopy link AcknowledgmentsCopy link Call for participationQuestions this post answers
How fast can a remote Spectre attack leak data from Cloudflare Workers in production?
Researchers demonstrated a reliable remote Spectre attack against Cloudflare Workers achieving up to 12 bit/s leakage with more than 99% accuracy in production. The attack combined a speculative type-confusion gadget, tree-based PLRU cache amplification, and a remote WebSocket timer, and was used to exfiltrate a JWT token bitwise from a co-located victim Worker. daily.dev surfaces deep security research like this for teams hardening multi-tenant runtimes against side-channel leaks.
What defenses has Cloudflare added to Workers to mitigate Spectre attacks after this research?
Cloudflare deployed hardware-assisted in-process isolation using Memory Protection Keys (MPK) in September 2025, integrated the V8 Sandbox to remove raw 64-bit pointers from typed-array backing stores, and improved its Dynamic Process Isolation (DyPrIs) system to detect long-lived Durable Object and WebSocket-heavy workloads that previously evaded post-execution isolation checks. Track how platforms like Cloudflare respond to Spectre-class threats by following security engineering updates on daily.dev.
Why didn't Cloudflare's Dynamic Process Isolation (DyPrIs) detect this Spectre attack sooner?
DyPrIs only isolated scripts after an invocation finished, but the attack used Durable Object WebSocket keep-alive messages to hold a single invocation open for hours, letting the leak complete before isolation triggered. It also normalized branch mispredictions by iTLB accesses, and the attack's heavy WebSocket I/O inflated iTLB activity enough to push the detection ratio below threshold. Engineers designing runtime anomaly detection can learn from these evasion patterns via security writeups on daily.dev.