Cloudflare: a 25-minute outage hits 28% of HTTP traffic after a security fix

2025-12-05 · Publisher : Cloudflare · Domain : Cloud & DevOps

On 5 December 2025, a configuration update meant to protect customers from the React flaw (CVE-2025-55182) takes down the older FL1 proxy: 25 minutes of 500 errors on about 28% of HTTP traffic.

### Background On 5 December 2025, from 08:47 to 09:12 UTC (**25 minutes**), **Cloudflare** returned HTTP 500 errors on about **28% of its HTTP traffic**. Its post-mortem describes a chain of configuration changes. First change: the buffer size for analysing request bodies went from 128 KB to 1 MB, to protect customers from flaw **CVE-2025-55182** (React Server Components). Second change: an internal web application firewall testing tool, incompatible with that size, was disabled through the global configuration system. ### Key facts - Only customers served by the older **FL1** proxy with Cloudflare's managed ruleset were affected. - Disabling the testing tool triggered a Lua exception in FL1's rulesets module: the code processed an "execute" action that no longer existed and read a nil value ("attempt to index field 'execute' (a nil value)"). - The change was reverted at 09:11 UTC; propagation completed at 09:12 UTC and all traffic was restored. - It is Cloudflare's second large-scale incident in less than three weeks, after the one on 18 November. ### Why it matters The incident shows the risk of an urgent security fix: speed of deployment conflicts with progressive caution. It also reminds us that a platform migrating from an old proxy to a new one makes two behaviours coexist, with blind spots. For IT leaders, it is an argument for requiring edge providers to roll out in stages even for emergency security changes. ### Takeaway A security fix deployed fast caused 25 minutes of outage: urgency does not excuse progressive rollout.

Tags : Incident, Edge, Sécurité, Cloud