workerd is vulnerable to Use After Free
69
Medium Risk
Some asynchronous I/O continuations registered through IoContext::awaitIo completed with lambdas that captured the native receiver only by raw this, without keeping the associated JavaScript object alive across the suspension. If the surrounding object could be collected or torn down before the callback ran, those continuations could still execute and touch freed storage. The update threads a JSG_THIS capture into the relevant callbacks so the wrapper lifetime covers the async completion in both the analytics write and abort-handling paths.
You are affected if you are using a version that falls within the vulnerable range.
workerd is vulnerable to Use After Free in versions 1.20250327.0 - 1.20260429.1.
Upgrade the workerd library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant