Skip to content

workerd / Cloudflare Code Mode: five memory-corruption bugs enable sandbox escape and cross-tenant "heap swipe"

Summary

Check Point Research's August 6, 2026 writeup "When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers" (presented at Black Hat USA 2026 with public proof-of-concept code) documents five memory-corruption vulnerabilities in workerd's native C++ layer — the in-process "glue" between JavaScript and the runtime in Cloudflare's open-source edge runtime workerd. workerd is the isolation substrate for both Cloudflare Workers (multi-tenant serverless, >10% of all traffic on Cloudflare's network) and the new Code Mode technique for AI-agent tool use, where an LLM writes a TypeScript program against a typed tool API instead of emitting one structured tool call at a time.

Because workerd isolates untrusted tenants in V8 isolates inside a single shared process — a software boundary, not an OS/hardware one — the five bugs collapse into two end-to-end attacks:

  1. Cross-tenant heap swipe (Workers) — an out-of-bounds read in URLPattern lets one Worker reach across the shared process heap and read another tenant's secrets.
  2. Code Mode sandbox escape — starting from a prompt injection, a use-after-free in node:zlib breaks out of the sandbox and executes native code on the host.

Cloudflare rated two of the five bugs Critical. Cloudflare's managed Workers environment was fixed in production; self-hosted workerd / Code Mode deployments should update to workerd v1.20260619.1. No in-the-wild exploitation or actor attribution is reported.

Tags

Why this matters

  • Code Mode changes the agent attack surface. In classic MCP/tool-calling loops the model emits one {tool, args} call per step; in Code Mode the model writes one program that orchestrates many tool calls locally. The generated code runs in workerd's Code Mode sandbox — so prompt injection that reaches Code Mode now lands in a runtime whose security model is a single in-process V8 isolate boundary, not a container or VM. A sandbox escape from that boundary is a host-code-execution primitive on an edge platform carrying more than 10% of Cloudflare's network traffic.
  • The blast radius is the whole multi-tenant runtime. workerd packs many customers' untrusted code into one process; V8 isolates are the tenant boundary. Memory corruption in the native glue defeats that boundary for both tenants (cross-tenant read) and the host (sandbox escape) — the two failure modes a shared-edge-runtime operator has to treat as equivalent to cross-tenant data breach.
  • The "glue" layer is the recurring soft spot. Same family as isolated-vm's ExternalCopy handoff and JSONata's host-object bridge: a "safe" sandbox whose native binding code between the JS world and the host reaches across the trust boundary.

The two demonstrated attacks

1. Cross-tenant heap swipe (URLPattern OOB read). An out-of-bounds read in URLPattern allows one Worker to read across the shared process heap and exfiltrate another tenant's secrets — a direct cross-tenant data-theft primitive against the Workers multi-tenant model.

2. Code Mode sandbox escape (node:zlib use-after-free). Starting from a prompt-injection position inside Code Mode, a use-after-free in the node:zlib native module breaks out of the isolate sandbox and executes native code on the host — the full prompt-injection-to-host-execution chain.

The five underlying bugs are memory-corruption flaws in workerd's native C++ (the glue between JavaScript and the runtime); Check Point released proof-of-concept code with the Black Hat USA 2026 talk.

Affected / patched

Component Exposure Mitigation
Cloudflare managed Workers Fixed in production by Cloudflare No action required for managed Workers
Self-hosted workerd (GitHub cloudflare/workerd) Cross-tenant + sandbox-escape exposure until patched Update to v1.20260619.1 or later
Code Mode deployments (AI-agent MCP tool-execution sandboxes on workerd) Prompt-injection-to-host path Update workerd; treat Code Mode output as untrusted native-code-adjacent input; add egress/tenant isolation controls

Defender notes

  • Self-hosted workerd is the action item: inventory any self-hosted workerd/Code Mode deployments and pin to v1.20260619.1 or later; verify the running version rather than the installed artifact.
  • For Code Mode specifically: prompt injection is a standing pre-condition. If an agent's Code Mode sandbox can reach declared MCP tools only, verify that fetch()/connect() are indeed refused (the documented lockdown) and that no binding grants broader access; the research shows the runtime itself, not the tool bindings, was the break point.
  • Hunting context: cross-tenant read via URLPattern OOB and a node:zlib UAF-driven host escape will not look like typical edge-app abuse; correlate unusual workerd process crashes / native-code execution anomalies on self-hosted deployments.

Assessment limits

  • No in-the-wild exploitation or actor attribution is reported; the two demonstrated attacks are researcher PoCs (public, Black Hat USA 2026).
  • The bug count (five, two Critical per Cloudflare) and the per-bug locations (URLPattern, node:zlib) come from Check Point Research; the full per-bucket CVE/GHSA assignment is not itemized in the writeup captured here.

Sources