TechPrufer
Sign inGet started

Blogs›Cloudflare›cdnjs Security & Vulnerability Management

cdnjs Security & Vulnerability Management

cdnjs Security & Vulnerability Management

4
posts
2019–2026

Cloudflare's cdnjs platform has evolved its security posture and operational architecture by migrating its entire ecosystem to Cloudflare's Developer Platform. This includes leveraging R2 for single source of truth file storage, KV for metadata, Workers Cache for tiered caching, and Cloudflare Workflows for a robust, durable ingestion pipeline. The migration addresses previous pain points in observability, storage split-brain, pipeline orchestration, and GitHub repository limitations, leading to a more secure, scalable, and maintainable system. The platform now supports larger file types and offers improved resilience and debugging capabilities.

2026

Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

7/30/2026

Migrated cdnjs from a hybrid GCP/Cloudflare architecture to an all-Cloudflare Developer Platform. This involved replacing GCP Functions, GCS, Pub/Sub, and a git-sync VM with Cloudflare Workflows, R2, KV, and Containers. Implemented durable execution for the ingestion pipeline using Workflows, Queues, and Durable Objects. Utilized R2 as the primary storage for all files, replacing the previous split-brain approach with GitHub. Enhanced observability by integrating logs and traces across the new platform. Introduced DigitalOcean Spaces as a disaster-recovery fallback for R2.

2021

Cloudflare's Handling of an RCE Vulnerability in cdnjs

7/24/2021

This post details Cloudflare's response to a Remote Code Execution (RCE) vulnerability in the cdnjs auto-update service. It outlines the immediate actions taken, including disabling the auto-update service, revoking credentials, and releasing a fixed version of the tool within 24 hours. The investigation confirmed no abuse beyond the researcher's demonstration. The remediation involved addressing path traversal issues by checking file destinations and implementing an AppArmor profile to limit service capabilities. A complete redesign of the auto-update pipeline into a microservices architecture was undertaken to isolate operations and libraries, preventing similar classes of attacks.

2020

JavaScript Libraries Are Almost Never Updated Once Installed

1/27/2020

This post analyzes aggregated request data from CDNJS to demonstrate that JavaScript libraries are rarely updated once installed on websites. It uses jQuery and TweenMax as examples, showing that older versions maintain significant popularity even as new versions are released. The analysis concludes that the underlying web platform must support aged conventions indefinitely and poses a question to the community about how to encourage updates.

2019

An Update on CDNJS

12/19/2019

Cloudflare is taking a more active role in the operation of CDNJS, including managing the CDNJS repository itself and serving the CDNJS project free of charge via cdnjs.cloudflare.com. This involves ensuring the bot that updates projects from npm is working and that commits are reviewed. The post also discusses the historical context of CDNJS, its success, and the technical details of how it works, including its GitHub repo structure and Cloudflare's infrastructure for serving the files.