cloudflare's nov 18 outage: one oversized file broke the edge
A database permissions change doubled a Bot Management config file, crashed Cloudflare's proxy, and returned 5xx errors for sites behind it for hours.
- impact window
- 11:20–17:06 UTC, 18 Nov 2025; core traffic largely restored by 14:30 UTC (Cloudflare)
- root cause
- ClickHouse permissions change produced a duplicated Bot Management feature file that exceeded a 200-feature limit and crashed the proxy
- services hit
- core CDN and security services, Turnstile, Workers KV, Access, dashboard login, Email Security
- attack?
- no — Cloudflare says it was not caused by a cyber attack or malicious activity
what happened
- Cloudflare says its network began experiencing significant failures to deliver core network traffic at 11:20 UTC on 18 November 2025.[1]
- The trigger was a database (ClickHouse) permissions change at 11:05 UTC that wrote duplicate rows into a Bot Management feature file, roughly doubling its size.[1]
- The oversized file exceeded the Bot Management module's 200-feature limit, causing the proxy software to panic and return HTTP 5xx errors.[1]
- Cloudflare says core traffic was largely flowing as normal by 14:30 UTC and all systems were functioning as normal at 17:06 UTC.[1]
- Turnstile failed to load, Workers KV returned elevated 5xx errors, Access saw widespread authentication failures, and most users could not log in to the dashboard.[1]
- Cloudflare stated the outage was not caused by a cyber attack and called it its worst outage since 2019.[1]
- In its follow-up 'Code Orange: Fail Small' plan, Cloudflare committed to staged, health-mediated rollouts of configuration changes with automatic rollback.[2]
where sources differCloudflare's post-mortem gives 11:20 UTC for the start of failures (its timeline lists customer impact from 11:28), core traffic largely restored at 14:30 and full recovery at 17:06; its later Fail Small post describes network traffic delivery failing for 'approximately two hours and ten minutes'.
sources3
- 01Cloudflare outage on November 18, 2025 ↗ primaryCloudflareaccessed 2026-10-21
- 02Code Orange: Fail Small — our resilience plan following recent incidents ↗ primaryCloudflareaccessed 2026-10-21
- 03Cloudflare Status ↗ primaryCloudflare Docsaccessed 2026-10-21