Cloudflare's workerd runtime underpins both Code Mode, a system allowing AI agents to write TypeScript code against APIs, and Cloudflare Workers, a serverless edge computing platform. Check Point Research discovered five memory corruption vulnerabilities in workerd's native C++ code, which acts as the interface between JavaScript and the runtime. Two critical vulnerabilities include: (1) an out-of-bounds read in URLPattern enabling one tenant's Worker to access another tenant's heap memory and secrets, and (2) a use-after-free triggered via node:zlib that allows sandbox escape and execution of native code on the host machine. These vulnerabilities undermine the isolation guarantees provided by V8 isolates, which are used to securely run multiple tenants' code within the same process. Cloudflare has deployed fixes in its managed Workers environment, and self-hosted deployments must upgrade to version v1.20260619.1 to mitigate these risks. Proof-of-concept exploit code was publicly released by Check Point Research.

The vulnerabilities allow attackers to bypass sandbox isolation in Cloudflare Workers and Code Mode environments. This can lead to cross-tenant data leakage by reading memory from other tenants' Workers and potentially executing arbitrary native code on the host system. Given the scale of Cloudflare Workers—serving millions of requests per second and hosting millions of developers—successful exploitation could compromise sensitive data and undermine the security of multiple tenants sharing the same runtime process. The critical severity reflects the potential for broad impact and loss of tenant isolation.

Cloudflare has fixed these vulnerabilities in its managed Workers environment. Operators of self-hosted workerd and Code Mode deployments should update to version v1.20260619.1 to apply the official fix. No additional mitigations are indicated or required beyond applying this update. Users should consult Cloudflare's advisory and Check Point Research's disclosures for detailed guidance.