cloudflare/workers-sdk miniflare@4.20260617.0

miniflare@4.20260617.0

Repository: cloudflare/workers-sdk

Tag: miniflare@4.20260617.0

Published: 2026-06-18T15:13:27Z

Prerelease: no

Release notes:

Patch Changes

• #14347 `673b09e` Thanks @jamesopstad! - Update undici from 7.24.8 to 7.28.0

• #14346 `e930bd4` Thanks @haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

• #14314 `5c3bb11` Thanks @harryzcy! - Bump esbuild to 0.28.1

This update includes several bug fixes from esbuild versions 0.27.3 through 0.28.1. See the esbuild changelog for details.

• #14331 `296ad65` Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

| Dependency | From | To | | ---------- | ------------ | ------------ | | workerd | 1.20260616.1 | 1.20260617.1 |