Edge runtimes block eval and new Function because running code built from strings is a common way for injected input to become executed code. Vercel states this is disabled for security reasons, and AWS says CloudFront Functions do not support dynamic code evaluation. Any dependency that relies on it fails at the edge.
What dynamic code evaluation means
Dynamic code evaluation is the practice of turning a string into running code. In JavaScript that usually means eval, or the Function constructor with a string body. A related case is compiling WebAssembly from bytes that arrive at run time.
The risk is easy to state. If any part of the string can be influenced by a request, an attacker may be able to run their own code inside your function. Removing the capability from the runtime removes the whole class, regardless of what a dependency author intended.
What the platforms document
Two edge platforms say this clearly in their documentation:
| Platform | What the docs state |
|---|---|
| CloudFront Functions | The runtime does not support dynamic code evaluation and restricts network, file system, environment variables and timers |
| Vercel Edge runtime | eval, new Function(evalString), WebAssembly.compile and WebAssembly.instantiate from a buffer are disabled, and dynamic code execution leads to a runtime error |
Vercel adds that WebAssembly.instantiate is supported only when the Wasm source is provided with an import statement. So you cannot compile a module from a byte array at run time.
Which dependencies are affected
You will not always see eval in your own code. It tends to hide in dependencies. Typical places, based on how these techniques are generally used:
- Template engines that compile templates into functions
- Schema validators that generate validation functions for speed
- Older utility libraries with a fallback that uses the Function constructor
- Code that loads Wasm from a buffer
A given package may or may not do this, and some do it only on certain paths. The reliable way to know is to test in the target runtime, not to guess.
How to check a dependency
- Search the installed package. Grep node_modules for eval and the Function constructor, including in nested dependencies.
- Read the docs for an edge or worker mode. Some libraries ship a build without code generation. Use that build.
- Run it on the real runtime. Deploy a preview and exercise the route. Vercel says dynamic code use produces a runtime error, which is visible.
- Pin the version that works. A new release can add generated code and break the route.
- Add the check to CI if you can, so a new dependency is checked before merge.
Is blocked eval a security control
It is a useful guardrail, not a full defense. It does not stop a package that sends data out over fetch, and it does not stop a logic bug that grants access it should not. It also protects only the platform-side path. If the same package runs elsewhere in your stack on a normal Node.js server, the eval there still works.
Treat it as one layer. Pair it with dependency scanning, a short allow list of packages for edge code, and review of anything that reads cookies, tokens or headers.
Try it yourself
Reachability analysis helps you separate a package that is installed from one that your code actually calls. Open the demo and look at how findings change when only reachable paths count.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard scans dependencies for known vulnerabilities and applies reachability analysis, which is useful when an edge route carries a handful of small packages and you want to know which findings matter. It does not test runtime compatibility. For that, use a preview deployment. Free scan: gold.safeguard.sh/scan.
Quick check
Is eval blocked on every edge platform?
Not necessarily. This post covers what CloudFront Functions and Vercel's Edge runtime document. Check the documentation of any other platform you use.
My code never calls eval. Can my route still fail?
Yes, if a dependency does. Vercel says libraries that rely on dynamic code execution cause a runtime error in the edge runtime.
Sources
Last reviewed: 19 October 2026.
