Spectre Attack Leaks JWT From Cloudflare Workers at 12 Bits/Second

Cybersecurity researchers have disclosed a practical remote Spectre side-channel attack against Cloudflare Workers that exfiltrated a JSON Web Token (JWT) from a co-located Worker in production at up to 12 bits per second—roughly 360 times the throughput of an earlier attack demonstrated in 2021. The end-to-end test used an attacker Worker and a victim Worker both controlled by the research team, with the JWT deliberately placed in victim memory. Cloudflare confirmed the research paper's finding that no customer data was accessed and stated it has already deployed mitigations after upgrading Dynamic Process Isolation (DyPrIs), integrating the V8 Sandbox, and rolling out Memory Protection Keys (MPK)-based in-process isolation. The company also reported no indicators of active exploitation over the past three years.

Cloudflare Workers executes multi-tenant code in separate V8 isolates within a single operating-system process, prioritizing language-level isolation over strict process boundaries to cut startup latency. According to Cloudflare, any in-process memory read can potentially leak across tenants, and the new attack required both attacker and victim to share that process. The platform restricts local timing sources by freezing or coarsening timers during CPU execution and denies scripts access to shared memory or threads. Researchers discovered that WebSocket traffic supplied a remote timing primitive, while Durable Objects sustained a single Worker isolate for anywhere between five and more than 20 hours, keeping it active long enough for DyPrIs to defer isolation until after the malicious invocation finished. WebSocket-heavy I/O also increased iTLB pressure, suppressing the normalized branch-misprediction signal DyPrIs depends on.

"We demonstrate that the production implementation of DyPrIs was insufficient," the researchers wrote, contrasting their position with Cloudflare's framing of the issue as an implementation limitation. They argued that robust defenses must monitor execution in real time and rely on a signal I/O activity cannot mute. Testing was carried out on Linux servers running AMD EPYC Zen 2 and Zen 3 CPUs during off-peak nighttime windows, when utilization sat between 10% and 25%. Native code execution remains outside the threat model and no V8 software exploit or sandbox escape was used, narrowing the attack surface to microarchitectural leaks alone.

The disclosure underscores how Spectre-class vulnerabilities continue to evolve against serverless and multi-tenant cloud platforms. Organizations relying on shared infrastructure should review their exposure to side-channel risks and audit authentication tokens; admins can validate their external attack surface with the SSL/TLS checker and confirm browser-side fingerprinting resilience via the browser fingerprint test. A broader privacy checkup helps surface credential and token exposure that might otherwise remain invisible.