workerd

👷 workerd, Cloudflare's JavaScript/Wasm Runtime

Latest 1.20261015.1

88%

Total Score

healthy

Active releases and broad maintenance support this package, but its workflows have widespread unpinned actions and several audit findings.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 24 workflows were analyzed, but 62 of 67 action references are unpinned; high-confidence findings also include template-injection patterns, an unpinned container image, and archived actions. The absence of untrusted checkouts or script injection limits this to a hygiene caution rather than a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-123108 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Use-After-Free in versions 0.0.1 - 1.20260804.1.	0.0.1 - 1.20260804.1	Medium
AIKIDO-2026-920595 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Denial of Service (DoS) in versions 1.20260305.1 - 1.20260807.2.	1.20260305.1 - 1.20260807.2	Medium
AIKIDO-2026-182313 workerd is vulnerable to Buffer Underwrite (Buffer Underflow) in versions 1.20221111.0 - 1.20231030.1.	1.20221111.0 - 1.20231030.1	Medium
AIKIDO-2026-455718 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Improper Input Validation in versions 0.0.1 - 1.20260618.1.	0.0.1 - 1.20260618.1	Medium
AIKIDO-2026-10705 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. workerd is vulnerable to Use After Free in versions 1.20250327.0 - 1.20260429.1.	1.20250327.0 - 1.20260429.1	Medium