On December 5, 2025, at 08:47 UTC (all times in this blog are UTC), a portion of Cloudflare鈥檚 network began experiencing significant failures. The incident was resolved at 09:12 (~25 minutes total impact), when all services were fully restored.A subset of customers were impacted, accounting for approximately 28% of all HTTP traffic served by Cloudflare. Several factors needed to combine for an individual customer to be affected as described below.The issue was not caused, directly or indirectly, by a cyber attack on Cloudflare鈥檚 systems or malicious activity of any kind. Instead, it was triggered by changes being made to our body parsing logic while attempting to detect and mitigate an industry-wide vulnerability disclosed this week in React Server Components.Any outage of our systems is unacceptable, and we know we have let the Internet down again following the incident on November 18. We will be publishing details next week about the work we are doing to stop these types of incidents from occurring. The graph below shows HTTP 500 errors served by our network during the incident timeframe (red line at the bottom), compared to unaffected total Cloudflare traffic (green line at the top). Cloudflare's Web Application Firewall (WAF) provides customers with protection against malicious payloads, allowing them to be detected and blocked. To do this, Cloudflare鈥檚 proxy buffers HTTP request body content in memory for analysis. Before today, the buffer size was set to 128KB.As part of our ongoing work to protect customers using React against a critical vulnerability, CVE-2025-55182, we started rolling out an increase to our buffer size to 1MB, the default limit allowed by Next.js applications. We wanted to make sure as many customers as possible were protected.This change was being rolled out using our gradual deployment system, and, as part of this rollout, we identified an increase in errors in one of our internal tools which we use to test and improve new WAF rules. As t...
First seen: 2025-12-05 16:16
Last seen: 2025-12-06 22:20