Intel

AIKIDO-2026-10705

workerd is vulnerable to Use After Free

Use After Free Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published May 4, 2026

69

Medium Risk

This Affects:

JSworkerd
1.20250327.0 - 1.20260429.1
Fixed in 1.20260430.1
Are you affected? Scan for Free

TL;DR

Some asynchronous I/O continuations registered through IoContext::awaitIo completed with lambdas that captured the native receiver only by raw this, without keeping the associated JavaScript object alive across the suspension. If the surrounding object could be collected or torn down before the callback ran, those continuations could still execute and touch freed storage. The update threads a JSG_THIS capture into the relevant callbacks so the wrapper lifetime covers the async completion in both the analytics write and abort-handling paths.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

workerd is vulnerable to Use After Free in versions 1.20250327.0 - 1.20260429.1.

How to fix this

Upgrade the workerd library to the patch version.