cloudflare dec 5 outage: a react patch rollout hit 28% of traffic
While rushing WAF protection for a critical React vulnerability, Cloudflare flipped a global killswitch that hit a years-old bug and returned HTTP 500s for about 25 minutes.
- duration
- ~25 minutes, 08:47–09:12 UTC (Cloudflare)
- root cause
- a global killswitch hit a latent Lua bug in the FL1 proxy's rules module during a WAF change for CVE-2025-55182
- services hit
- HTTP traffic for FL1-proxy customers with the Cloudflare Managed Ruleset (about 28% of Cloudflare HTTP traffic)
- attack?
- no — Cloudflare says it was not caused by a cyber attack
what happened
- Cloudflare's outage on 5 December 2025 ran from 08:47 to 09:12 UTC, about 25 minutes of total impact.[1]
- Cloudflare says approximately 28% of all HTTP traffic it served was affected.[1]
- Cloudflare was raising its WAF request-body buffer from 128KB to 1MB to protect React users against CVE-2025-55182 when a second change, a global killswitch disabling an internal WAF test tool, triggered a Lua error in its older FL1 proxy.[1]
- Only customers on the FL1 proxy with the Cloudflare Managed Ruleset deployed were affected; the bug did not occur in the Rust-based FL2 proxy.[1]
- Cloudflare stated the issue was not caused by a cyber attack on its systems.[1]
- Cloudflare said safeguards planned after the 18 November outage would have helped prevent this impact but were not yet fully deployed.[1]
- Cloudflare's 'Code Orange: Fail Small' plan set the end of Q1 2026 as the target for health-mediated configuration deployment across production systems.[2]
where sources differThe 5 December post-mortem says about 28% of all HTTP traffic was affected; Cloudflare's later Fail Small post describes it as failing to serve traffic for 28% of applications behind its network.
sources3
- 01Cloudflare outage on December 5, 2025 ↗ primaryCloudflareaccessed 2026-10-21
- 02Code Orange: Fail Small — our resilience plan following recent incidents ↗ primaryCloudflareaccessed 2026-10-21
- 03Cloudflare Status ↗ primaryCloudflare Docsaccessed 2026-10-21