A Second Home for polyfill.io on cdnjs

Polyfill.io has long been a standard tool for taming the inconsistencies of older browsers. By injecting support for modern JavaScript functions into legacy environments, it lets developers code against a single, predictable baseline instead of wrangling version-specific quirks. Until now, the service was typically loaded via its own domain, polyfill.io.

Cloudflare is now offering an alternative endpoint under its established cdnjs infrastructure. Developers can swap their existing polyfill.io links for the new cdnjs-hosted URLs without changing any other part of their integration. The aim is parity: the same behavior, but served from the same infrastructure that cdnjs uses to distribute libraries to over 12% of all websites.

The move follows community concern about the handover of the polyfill.io domain to a new provider, Funnull. With that transfer, any site still linking to the original domain is implicitly trusting the new maintainers to keep the code secure and unaltered. A compromise there could cascade into a supply chain attack affecting every site that loads the script. cdnjs’ new endpoint gives developers a way to cut that dependency without having to migrate away from the polyfill service itself.

This is also the kind of third-party risk that Cloudflare’s Page Shield product is designed to surface and mitigate for security teams monitoring their web applications.

Using the New Endpoint

The full polyfill.io implementation is now live at:

https://cdnjs.cloudflare.com/polyfill/

Direct bundle links are available in both forms:

Deployment is meant to be a drop-in replacement. Developers should be able to swap the old URL for the new one without side effects, and in some cases may even see modest performance gains. For sites behind Cloudflare that do not have direct access to their underlying code, a Worker can perform the link substitution on the fly. Instructions for deployment are in the developer documentation, and the Worker can also be tested without a full deployment using the guidance in this earlier post on Workers and WebPageTest.

Built on Rust and Cloudflare Workers

The polyfill.io service itself is a Rust project, a language that has been supported on Cloudflare Workers from the start. Since the original service was hosted on Fastly and used the Fastly Rust library, the Cloudflare team forked the codebase to add Workers compatibility; they plan to make the fork public. The new https://cdnjs.cloudflare.com/polyfill/[...].js endpoints are served by a Worker wrapper that calls into that fork.

The wrapper is intentionally thin. It configures internal metrics and logging so uptime and performance can be monitored, then delegates to the polyfill logic:

#[event(fetch)]
async fn main(req: Request, env: Env, ctx: Context) -> Result<Response> {
    let metrics = {...};

    let polyfill_store = get_d1(&req, &env)?;
    let polyfill_env = Arc::new(service::Env { polyfill_store, metrics });
    
    // Run the polyfill.io entrypoint
    let res = service::handle_request(req2, polyfill_env).await;

    let status_code = if let Ok(res) = &res {
        res.status_code()
    } else {
        500
    };
    metrics
        .requests
        .with_label_values(&[&status_code.to_string()])
        .inc();

    ctx.wait_until(async move {
        if let Err(err) = metrics.report_metrics().await {
            console_error!("failed to report metrics: {err}");
        }
    });

    res
}

Storage Design

Under the hood, the polyfill files are stored in a key-value store powered by Cloudflare D1. That choice matters for performance: fetching all required polyfill files can be done in a single SQL query rather than issuing a separate KV get per file, as the original implementation does. To keep latency low, Cloudflare runs one D1 instance per region and routes queries to the nearest database.

A Continued Role for cdnjs

With over 6,000 JavaScript libraries already hosted, cdnjs treats polyfill.io as another addition to its roster. The team is soliciting community input on the service via the Cloudflare community forum and cdnjs on GitHub. For customers on paid plans, Page Shield is available as a one-click enablement to monitor the security of third-party assets across their sites.