Security vulnerabilities and automated fixes for cloudflare workers issues
3 posts found
A critical denial-of-service vulnerability in `_workers.js` allowed attackers to send arbitrarily large or deeply nested JSON payloads to the `/api/log-speed` POST endpoint, causing the Cloudflare Worker to exhaust CPU and memory during parsing. The fix adds a Content-Length header check before calling `await request.json()`, rejecting payloads over 10 KB with an HTTP 413 response. This prevents resource exhaustion attacks while preserving all legitimate functionality.
A critical misconfiguration in `platforms/m365/wrangler.toml` left developers one copy-paste away from committing live API keys directly into git history. The fix adds an explicit warning comment blocking the `[vars]` anti-pattern and adds `.dev.vars` to `.gitignore`, ensuring secrets flow through Cloudflare's encrypted `wrangler secret` mechanism instead of plaintext config. This matters because git history is permanent — a key committed even once can be extracted long after it's "deleted."
A critical Server-Side Request Forgery (SSRF) vulnerability was discovered in `functions/stream/createProxyResponse.js`, where the `location` parameter was passed directly to `fetch()` without any URL validation. This allowed attackers to weaponize the proxy function to reach internal network resources, cloud metadata endpoints, and arbitrary external services. The fix adds protocol validation using the `URL` constructor before any fetch operation is performed.