cdnjs vs jsDelivr vs unpkg: what still differs now that browser caches are partitioned
- vuetelemetry
- Ferramentas
- 8 min de leitura
Cloudflare has just rebuilt cdnjs on its own developer platform without changing a single URL. It is a good moment to re-examine the choice between the three public JavaScript CDNs, because the argument most developers still use to justify them stopped being true in 2020.
Uma migração que ninguém devia notar
On 30 July 2026 Cloudflare published an account of how it rebuilt cdnjs, the public CDN it operates for JavaScript and CSS libraries, on top of its own developer platform; InfoQ relayed the story on 14 August. The numbers Cloudflare gives are worth stating plainly: cdnjs serves roughly 9 billion requests a day, averaging about 108,000 requests per second across more than 330 data centres, with a 98.6% cache hit rate, and is used by around 12% of websites.
The architecture changed underneath. R2 became the source of truth for published package files, KV holds package metadata, versions and Subresource Integrity hashes, and a Worker handles the requests with Workers Cache in front. What did not change is the part that matters to anyone who has ever pasted a script tag into a page: Cloudflare says package contents, URLs and SRI hashes were all preserved. The migration was designed to be invisible.
That invisibility is the real product. A public CDN makes exactly one promise worth having, which is that the URL you pasted into your <head> five years ago still answers the same bytes today. Everything else - the edge count, the cache hit rate, the runtime it is built on - is implementation detail. Judge these services on whether they can change everything underneath without changing anything you depend on.
Três CDN, três promessas diferentes
The three usual candidates are not the same kind of thing, and conflating them is the most common mistake. cdnjs serves a curated catalogue of libraries: a human process decides what gets in. jsDelivr serves npm packages, GitHub repositories and ESM builds, and runs as a multi-CDN, fanning requests across Cloudflare and Fastly. unpkg is the simplest of the three: a direct mirror of npm, where anything published is immediately reachable by URL.
O argumento que deixou de ser verdade em 2020
Now the argument that has to go. For years the standard justification for a public CDN was the shared cache: use the CDN everyone else uses, and your visitor will already have jQuery cached from another site, so it costs nothing. This has not been true for a long time. Browsers now partition the HTTP cache by the site you are visiting - Safari has done so since 2013, Chrome since version 86 in 2020, Firefox since version 85 in 2021.
- cdnjs - curated catalogue, operated by Cloudflare; the 2026 rebuild preserved URLs, package contents and SRI hashes
- jsDelivr - npm, GitHub and ESM; multi-CDN across Cloudflare and Fastly; files already served are kept even if the package disappears
- unpkg - a direct mirror of npm: the simplest of the three, and the most exposed to upstream changes
- The cross-site shared cache is gone: Safari 2013, Chrome 86 in 2020, Firefox 85 in 2021 - the historic argument for public CDNs no longer applies
- Always add integrity and crossorigin to a third-party tag; with a modern bundler, self-hosting is often faster and safer than any of the three
Partitioning means a file downloaded on site A is downloaded again on site B, even for the identical URL on the identical CDN. The change was made for privacy: a shared cache leaks browsing history, because a site can time a fetch and infer whether you have visited somewhere else. The performance benefit was real, it was traded away deliberately, and any advice that still rests on it is repeating a pre-2020 web.
O que realmente os separa hoje
Strip that argument out and the comparison becomes narrower and more honest. What is left is availability, immutability, and how much third-party surface you are willing to attach to your page. On immutability, jsDelivr states that once a file has been served it is stored permanently, so a package removed from npm keeps resolving rather than breaking the sites that referenced it. unpkg, being a mirror, follows npm more closely. Anyone who remembers left-pad disappearing from npm in 2016 knows this is not a hypothetical.
On availability, jsDelivr's multi-CDN design means one provider having a bad day does not take the service with it. cdnjs sits entirely on Cloudflare, and the 2026 migration made it more homogeneous rather than more redundant. That is a trade-off rather than a flaw: one very large operator with 330-plus locations against several operators with independent failure modes. Pick the failure mode you would rather explain.
O atributo integrity não é opcional
Whichever you choose, use Subresource Integrity. An integrity attribute with crossorigin="anonymous" tells the browser to refuse a file whose hash does not match, which is the difference between trusting a URL and trusting whoever controls it. Without it you have granted a third party unconditional execution rights on every page of your site. The tag in the photograph above has no integrity attribute, and that is the common case rather than the exception.
A opção que a maioria das comparações salta
Which leaves the option most comparisons skip: do not use a public CDN at all. Serve the library file from your own origin alongside the rest of your assets. Since the cache is partitioned you were not gaining anything from the shared cache anyway, and self-hosting removes a DNS lookup, a TLS handshake and a connection to a host you do not control. Your bundler already does this. For most sites in 2026 it is simultaneously the fastest and the safest choice.
One last piece of honesty about all three: they are offered on a best-effort basis, with no contractual uptime commitment. They are generous public infrastructure, not a service you are owed. If your page becomes unusable when a library fails to load, that dependency does not belong on someone else's free tier, however many data centres it has.
FAQ
Does a public CDN still make my site faster because the file is already cached from another site?
No. Browsers partition the HTTP cache by the site you are visiting, so a file fetched on one site is fetched again on another even when the URL and the CDN are identical. Safari has partitioned since 2013, Chrome since version 86 in 2020 and Firefox since version 85 in 2021. The change was made for privacy, because a shared cache lets a site infer which other sites you have visited by timing a fetch. Any recommendation that still relies on the shared cache is describing the pre-2020 web.
Did the 2026 cdnjs migration break existing URLs?
No. Cloudflare rebuilt cdnjs on its developer platform - R2 as the source of truth for published files, KV for package metadata, versions and SRI hashes, and a Worker serving requests - while preserving package contents, URLs and SRI hashes. The service reports roughly 9 billion requests a day at about 108,000 requests per second across more than 330 data centres, with a 98.6% cache hit rate. Existing script and link tags continue to work unchanged.
cdnjs, jsDelivr or unpkg - which should I choose?
If you need a curated library catalogue and are comfortable depending on a single very large operator, cdnjs is a reasonable default. If you want redundancy across providers and a guarantee that a file already served will keep resolving even if the package is removed from npm, jsDelivr's multi-CDN design and permanent storage fit better. unpkg is the most direct route to any npm package and the simplest to reason about, at the cost of tracking npm's own changes most closely. For most production sites, self-hosting the file is the better answer than all three.
Do I still need Subresource Integrity if I trust the CDN?
Yes. Subresource Integrity is not a statement about whether you trust the operator's intentions; it is what limits the damage if the file served at that URL ever changes, for any reason. Add an integrity attribute with the expected hash and crossorigin="anonymous", and the browser will refuse to execute a file that does not match. Without it, a third party holds unconditional execution rights on every page that carries the tag.
Whichever you choose, use Subresource Integrity. An integrity attribute with crossorigin="anonymous" tells the browser to refuse a file whose hash does not match, which is the difference between trusting a URL and trusting whoever controls it. Without it you have granted a third party unconditional execution rights on every page of your site. The tag in the photograph above has no integrity attribute, and that is the common case rather than the exception.