JavaScript is Running Out of Room

Most people think the internet runs on servers. It doesn't anymore. It runs on JavaScript, and JavaScript is running out of room.

The median web page now weighs 2.6 megabytes on desktop. That's a five-fold increase in fifteen years. JavaScript alone accounts for over 600 kilobytes of that, and it surpassed images as the most requested resource type last year. The 90th-percentile page—where the big news sites, e-commerce platforms, and media companies live—weighs over 11 megabytes. A single New York Times article recently pulled down 49 megabytes across 422 network requests.

What's striking isn't the size. It's what the size means. The actual article text in that 49 megabytes is probably under a megabyte. The rest is UI frameworks, tracking scripts, consent banners, ads, chat widgets, and the glue code holding them together. You went to read a news story. The network delivered the equivalent of an MP3 album.

This is not an accident of bad engineering. It's the inevitable output of a monoculture.

Every company shipping a product online uses JavaScript. Not "most companies"—every company. If you want to reach the broadest possible audience with the lowest deployment friction, there is one language, one package registry, and one default toolchain. npm absorbed roughly 9.8 trillion downloads in 2025. More than 99% of all open-source malware identified that year landed on npm. The JavaScript ecosystem is simultaneously the most essential piece of infrastructure on the internet and the most compromised.

The contradiction is that the monoculture makes JavaScript's problems inescapable. Bloat compounds because every developer stands on the same shoulders, and those shoulders are made of other people's dependencies. A typical e-commerce site loads 30-plus npm modules, each pulling in its own transitive chain. A bare React scaffolding ships 150 to 200 kilobytes of framework code before you've written a single line of your own. On a budget Android phone, parsing 450 kilobytes of compressed JavaScript—about the mobile median—burns 225 to 360 milliseconds of CPU time just to compile, before any code runs. On a cheaper phone, that doubles. A 100-millisecond delay in page load can drop conversion rates by 7%. This is a revenue problem wearing the clothes of a performance problem.

The security crisis is the same monoculture viewed from the other side. Over the past year, the threat model shifted from opportunistic criminals to state-sponsored operators. In June 2026, a North Korean group called Sapphire Sleet compromised the Mastra AI agent framework in 19 minutes, publishing a malicious helper dependency and republishing 140-plus packages to harvest cryptocurrency wallets and cloud credentials. In May, another campaign hit 373 versions across 169 TanStack packages, exposing roughly 520 million weekly downloads. The day before, 639 malicious versions across 323 AntV packages were published in an hour. The common thread: npm's postinstall hook runs code automatically when you install a package. No one has to click anything. It's a supply chain where the delivery mechanism executes before you open the box.

So what happens to the companies that sell you a way to survive the monoculture?

Cloudflare is the clearest example. Its business is built around the premise that the internet is too slow and too insecure to manage on your own servers. The CDN, DDoS protection, edge compute, zero-trust networking—it's all infrastructure that becomes more valuable as the web gets more complex and more exposed. Q2 2026 revenue hit $696 million, up 36% year over year, beating a consensus estimate of roughly $665 million. RPO (remaining performance obligations, a measure of contracted future revenue) grew 35%. The company now has over $4.1 billion in cash and is guiding the full year to $2.86–2.87 billion in revenue. That's growth acceleration, not deceleration.

But here's the thing most people miss about Cloudflare's valuation. The stock trades at roughly 48 times trailing sales. No matter how fast it grows, that multiple requires the growth to continue, accelerate, and eventually translate into sustained profitability. The company reports non-GAAP operating margins near 14%, which is fine, but GAAP operating loss hit $205 million in Q2—nearly 30% of revenue—driven by stock-based compensation. The market is buying the infrastructure story, not the earnings.

AInvest's aggregate signal labels the stock a Buy, with composite and fundamental ratings in the upper tier. That's what you'd expect from a company growing 36% in a category everyone is buying. Consensus is positive because the surface trend is undeniable. But the surface trend is what happens when you're the toll road on a highway that's getting wider, noisier, and more accident-prone every year.

The way to think about Cloudflare's thesis isn't whether the company executes. It's whether the JavaScript monoculture can keep expanding without triggering a reckoning.

There are three possible outcomes.

The first is benign: the web keeps bloating, keeps getting attacked, and keeps paying companies like Cloudflare to manage the mess. This is the base case the current multiple assumes. It requires that JavaScript's dominance is self-reinforcing—that the switching costs of leaving the npm ecosystem are higher than the pain of living in it. For most companies, they are. The alternative to npm is not a better ecosystem; it's building your own. The alternative to JavaScript is not Python or Go on the client; it's WebAssembly, and that's not a replacement yet. It's a long way off for the 95% of sites that don't need its performance advantages.

The second outcome is the reckoning. The bloat becomes intolerable enough that browsers or search engines start forcing a contraction. Google already penalizes slow Core Web Vitals, and there's talk of more aggressive client-side restrictions. A 2025 vulnerability in React Server Components showed that JavaScript has now penetrated enterprise infrastructure so deeply that a framework-level bug can break production systems at the architectural level. If the industry responds by restricting JavaScript execution, sandboxing install scripts by default, or mandating provenance verification for all dependencies, the monoculture cracks. That would be painful for every developer on earth. But it could also be a positive for Cloudflare, which would become the enforcement layer for whatever new constraints emerge.

The third outcome is the one no one models. JavaScript doesn't collapse. It doesn't survive smoothly. It splits into two ecosystems: one for high-assurance infrastructure (locked down, audited, slower-moving) and one for the consumer web (fast, flexible, perpetually compromised). Cloudflare would be the toll road on both lanes, but the security economics of the infrastructure lane would dominate the margin picture. That's a better business than the current one assumes, because enterprise security contracts pay better than CDN bandwidth.

I suspect the third outcome is most likely. The evidence is in the attack patterns. Nation-state actors don't target JavaScript because they like it. They target it because everything important runs on it. When the most downloaded packages become weapons, the companies that use them stop treating security as an optional add-on and start treating it as a governance requirement. Cloudflare is already positioning for that shift—its recent move to unify Workers AI and AI Gateway into a single control plane is about becoming the choke point for AI traffic routing, observability, and access control. It's not selling bandwidth anymore. It's selling governance.

The test for this view is simple. Watch what happens when browsers start enforcing stricter JavaScript sandboxing or when npm defaults to disabling lifecycle scripts. If Cloudflare's growth stays above 30% through that transition, the monoculture thesis is wrong—it's a governance thesis, and the company is correctly positioned for a narrower but more profitable role. If growth slows and margins don't expand, the current multiple is buying a story that only works while JavaScript continues its unimpeded expansion.

The way most people evaluate Cloudflare is by checking whether it beat revenue consensus and whether the guidance was raised. Both were true this quarter. That's not a wrong way to think about it. It's just not deep enough. The question isn't whether Cloudflare will grow. The question is whether it's growing because the web needs it or because the web has no alternative. Those are not the same thing.