Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cloudflare/workerd

              main @ 97aa54b
            

104

Fixes

CVEs

CRITICAL

Peak severity

41.0%

Coverage

Highlights

Denial of Service: 23 prior fixes. Scrutinize any change in this area.

src/workerd/api/streams/internal.c++: most-fixed (5 issues). Treat as high-risk during review.

79 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Use-After-Free: Dominant vulnerability class (16+ fixes) driven by re-entrant JavaScript executing during promise resolution, abort, or read/write operations, freeing C++ objects that are subsequently dereferenced. Multiple fixes add weak-ref liveness checks and DisallowJavaScriptScope guards, indicating a systemic pattern of missing lifetime validation after JS callbacks.

Denial of Service: 23 DoS fixes, many causing process-wide crashes affecting all tenants. Recurring root causes: throwing destructors, unbounded recursion (regex, proxy unwrap, path building), allocator mismatches, and TOCTOU on resizable ArrayBuffers. These are cross-tenant availability risks requiring strict input bounds and exception-safe cleanup.

Sandbox Escape: Multiple critical fixes show the SQLite authorizer/regulator as a primary sandbox boundary. Vulnerabilities allowed bypassing the authorizer at execute time, unrestricted function/pragma access, and temp-table operations, enabling access to internal _cf_ tables and privileged operations. The per-statement Regulator interface is the core control.