workerd

👷 workerd, Cloudflare's JavaScript/Wasm Runtime

Latest 1.20261013.1

NPM

86%

Total Score

healthy

Daily stable releases and active Cloudflare maintenance outweigh substantial workflow pinning and audit-hygiene gaps.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

An install-time postinstall script runs during installation, adding execution and deployment complexity that developers should account for.

Workflow audit

The audit analyzed all 24 workflows without failures, but 62 of 67 action references are unpinned and it found high-confidence template-injection, unpinned-image, archived-action, and ad hoc package issues; these are meaningful workflow hygiene concerns, though no untrusted checkout or script-injection sink was reported.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-123108 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Use-After-Free in versions 0.0.1 - 1.20260804.1.	0.0.1 - 1.20260804.1	Medium
AIKIDO-2026-920595 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Denial of Service (DoS) in versions 1.20260305.1 - 1.20260807.2.	1.20260305.1 - 1.20260807.2	Medium
AIKIDO-2026-182313 workerd is vulnerable to Buffer Underwrite (Buffer Underflow) in versions 1.20221111.0 - 1.20231030.1.	1.20221111.0 - 1.20231030.1	Medium
AIKIDO-2026-455718 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Improper Input Validation in versions 0.0.1 - 1.20260618.1.	0.0.1 - 1.20260618.1	Medium
AIKIDO-2026-10705 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Use After Free in versions 1.20250327.0 - 1.20260429.1.	1.20250327.0 - 1.20260429.1	Medium