The nodejs_compat flag exposes a subset of Node.js APIs in Workers, and Wrangler fills some gaps with polyfills. Some of those are mocks that do nothing or throw errors. For reviewers, that means a package that installs and builds may still behave differently at the edge than in Node, including its security checks.
What the flag does
Cloudflare documents that Workers provides a subset of Node.js APIs. Most are full implementations, and a few are partially supported. Some modules are non functional stubs that can be imported but have no working implementation. The documentation says many npm packages rely on Node APIs and will not work unless those APIs are available.
The flag is opt in for compatibility dates from 2024-09-23 through 2026-08-03, and enabled by default from 2026-08-04, with both nodejs_compat and nodejs_compat_v2 on. Setting no_nodejs_compat turns it off.
Where polyfills come in
Unsupported Node APIs are polyfilled by Wrangler using unenv. With the flag on and a date of 2024-09-23 or later, Wrangler automatically injects polyfills into your Worker's code. Polyfilled methods are mocks. They either do nothing or throw an error that states the method is not implemented yet.
Why that matters for security review
| Situation | Risk |
|---|---|
| A package calls a stubbed API and the call does nothing | A check, such as validation or cleanup, is silently skipped |
| A package calls an API that throws | The Worker fails, sometimes in an error path nobody tested |
| A polyfill replaces a platform feature | Behavior differs from the version you reviewed on Node |
| Dependencies change between dates | A move of the compatibility date can change what is injected |
A silent no op is the worrying case. Packages written for Node can assume that a file, network or crypto call did its job. At the edge that assumption can be false.
A review checklist
- List the packages that import Node built in modules, directly or through dependencies.
- For each, check the supported API list for the modules it uses.
- Search the dry run bundle for the unenv not implemented message to see which polyfills are included.
- Run integration tests in the Workers runtime, not just Node unit tests.
- Review security relevant packages first: authentication, signature verification, encryption, sanitizers.
- Record the compatibility date, flags and Wrangler version with each release.
- Re test whenever you move the date or upgrade Wrangler.
Prefer web standard alternatives when possible
Workers supports Web Crypto, URL and other web APIs. For security code, a package built on those standards avoids the polyfill question entirely. When you must use a Node oriented package, test its security behavior, not just its happy path.
Document the decision
Write down which Node APIs your Worker relies on and why. If a stubbed API is needed for a security control, treat that as a defect to resolve before release. This also helps the next reviewer understand why the flag is on.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings link to a code location. Reviewing which Node APIs your code calls starts the same way.
Quick check
Do polyfills make every npm package work on Workers?
No. Cloudflare says some modules are stubs, and polyfilled methods can do nothing or throw an error.
Is nodejs_compat on by default?
For compatibility dates of 2026-08-04 or later, yes. For earlier dates from 2024-09-23 you add the flag yourself.
Safeguard's SBOM, dependency scanning and code scanning cover the packages in your Worker project. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
