cloudflare / cloudflare/workerd

🐛 Workers sharing the same modules registry can result in unexpected behaviors

Open
#2,364 9 comments 0 reactions 1 assignee Claimed by @jasnell View on GitHub
Dominant language
C++
Stars
8.7k
Forks
739
Avg merge
2d 20h
Merged PRs (30d)
174

Description

As discussed with @jasnell each isolate gets its own global module registry that is shared and reused for the lifetime of the isolate.

Meaning that different worker runs can share the same module registry, in case modules include their own state this means that such state can be shared across different worker runs and this can result in incorrect/unexpected behaviors and even data leakage.

I've seen this creating issues in the wild (https://github.com/cloudflare/next-on-pages/issues/805) and I can imagine this potentially being problematic with any library that relies on top level modules state (but I am not sure how common that is).

Although unrealistic here's an example minimal reproduction of the issue: https://github.com/dario-piotrowicz/workerd-modules-sharing-issue-reproduction/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.