Executive brief
Cloudflare workerd is a JavaScript runtime that powers Cloudflare Workers and other edge computing services. A buffer under-read vulnerability in the FormData API could cause application crashes or undefined behavior if an attacker uploads a multi-gigabyte form-encoded request to a vulnerable deployment with sufficient memory. Practical exploitation is extremely unlikely due to the need for 160GB of RAM allocation and tens of gigabytes of data transfer.
Technical details
The vulnerability is an integer overflow in the FormData API implementation that occurs when iterating over FormData instances containing more than 2^31 elements. The forEach() method reads from incorrect memory locations, typically triggering a segmentation fault but potentially allowing arbitrary behavior. Attack vector is network-based but requires no privileges or user interaction; however, preconditions are severe: the process must allocate 160GB of RAM and receive a multi-gigabyte HTTP request body. The vulnerability was never exploitable on Cloudflare's managed platform. A patch was released in version v1.20230419.0; users should update immediately.
Affected products
- Cloudflare workerd < v1.20230419.0
Timeline
- 2023-05-12: disclosed
- 2023-04-19: patched: Patch released in version v1.20230419.0