{
  "id": "ai-breaks-cloudflare-workers-runtime",
  "type": "failures",
  "category": "failures",
  "locale": "en",
  "url": "/failures/ai-breaks-cloudflare-workers-runtime",
  "title": "How to Fix AI Breaking the Cloudflare Workers Runtime",
  "description": "AI agents import Node.js built-ins like fs, crypto, and path into Cloudflare Workers, causing runtime errors because the Workers runtime is not Node.js.",
  "tools": [
    "Cursor",
    "Claude Code",
    "Codex",
    "Windsurf"
  ],
  "stack": [
    "Cloudflare",
    "TypeScript"
  ],
  "tags": [
    "cloudflare",
    "security",
    "typescript"
  ],
  "difficulty": null,
  "updated": "2026-06-08",
  "markdown": "The agent writes code that works locally under Node.js but fails at deploy or\nruntime in Cloudflare Workers because the Workers runtime is a V8 isolate —\nnot Node.js.\n\n## The symptom\n\nThe agent imports Node.js built-ins or npm packages that internally require\nNode.js APIs.\n\n```ts\n// worker.ts — WRONG\nimport { createHash } from \"crypto\";          // Node built-in — not available\nimport { readFileSync } from \"fs\";            // Node built-in — not available\nimport { resolve } from \"path\";              // Node built-in — not available\nimport { IncomingMessage } from \"http\";      // Node built-in — not available\n\nexport default {\n  async fetch(request: Request, env: Env) {\n    const hash = createHash(\"sha256\").update(\"data\").digest(\"hex\");\n    return new Response(hash);\n  },\n};\n// Error at runtime: Cannot read properties of undefined (reading 'createHash')\n```\n\n## Why it happens\n\nMost agent training data targets Node.js. The model knows `crypto`, `fs`, and\n`path` work for hashing, file access, and path manipulation, so it reaches for\nthem. It doesn't distinguish the Workers runtime from Node.js unless explicitly\ntold.\n\n## How to spot it\n\n- `import ... from \"crypto\"` / `\"fs\"` / `\"path\"` / `\"http\"` / `\"stream\"` in\n  Worker files.\n- `wrangler dev` works but `wrangler deploy` throws a bundling warning about\n  unresolved Node.js modules.\n- The Wrangler compatibility flags section in `wrangler.toml` is missing or\n  uses a date before `2022-11-30`.\n- Dependencies that internally use `require(\"node:...\")` without a Workers\n  compatibility shim.\n\n## How to fix it\n\nUse Web Standard APIs — they are available natively in Workers.\n\n```ts\n// worker.ts — CORRECT\nexport default {\n  async fetch(request: Request, env: Env) {\n    // Web Crypto API — standard, available in Workers\n    const encoder = new TextEncoder();\n    const data = encoder.encode(\"data\");\n    const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n    const hashArray = Array.from(new Uint8Array(hashBuffer));\n    const hash = hashArray.map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n    return new Response(hash);\n  },\n};\n```\n\n```toml\n# wrangler.toml — enable Node.js compat shims for packages that need them\ncompatibility_date = \"2024-09-23\"\ncompatibility_flags = [\"nodejs_compat\"]\n```\n\n```txt\n[ ] No imports from \"crypto\", \"fs\", \"path\", \"http\", \"stream\", \"os\", \"buffer\" (use node: prefix + nodejs_compat flag if unavoidable)\n[ ] Use crypto.subtle for hashing/signing (Web Crypto API)\n[ ] Use env bindings (KV, R2, D1) instead of fs for storage\n[ ] Set compatibility_date to a recent date in wrangler.toml\n[ ] Add nodejs_compat flag only for third-party packages that require it\n[ ] Run \"wrangler deploy --dry-run\" to catch bundling errors before deploying\n```\n\n## Fix Prompt\n\n```txt title=\"Fix Prompt\"\nThis code imports Node.js built-in modules (crypto, fs, path, http) that are\nnot available in the Cloudflare Workers runtime. Rewrite it using Web Standard\nAPIs: crypto.subtle for hashing/encryption, the Fetch API for HTTP, and\nCloudflare bindings (KV, R2, D1) for storage. If a third-party dependency\nrequires Node.js APIs, add nodejs_compat to compatibility_flags in wrangler.toml\nand note that in a comment.\n```\n\n## Test\n\n```bash\n# Dry-run deploy to catch Node.js module errors\nwrangler deploy --dry-run --outdir dist 2>&1 | grep -i \"error\\|unresolved\\|node:\" && echo \"FAIL\" || echo \"OK\"\n\n# Check for raw Node built-in imports\ngrep -rn '^import.*from \"(crypto|fs|path|http|stream|os)\"' src/ \\\n  && echo \"FAIL: Node.js built-in import found\" || echo \"OK\"\n```"
}