On 5 December 2025 a change Cloudflare made while mitigating CVE-2025-55182 caused about 25 minutes of HTTP 500 errors for roughly 28 percent of the HTTP traffic it serves. Cloudflare states it was not caused by a cyberattack. A latent bug in older proxy code and a fast global config push combined.
What happened
Cloudflare's own write-up gives the times in UTC. The change was deployed at 08:47, impact peaked at 08:48, alerts declared the incident at 08:50, and it was reverted at 09:11 with all traffic restored at 09:12.
The trigger was a response to the React Server Components vulnerability. Cloudflare was rolling out a larger WAF request body buffer, from 128KB to 1MB, gradually. Separately, it disabled an internal WAF testing tool through its global configuration system, which pushes changes across the fleet within seconds with no gradual rollout.
Only customers served by the older FL1 proxy with the Managed Ruleset deployed were affected. Cloudflare says the killswitch disabled a rule that had an execute action, and the code then assumed an object existed when it did not, producing a nil value error and the 500 responses. It says the bug had gone unnoticed for years and did not occur in its newer Rust based proxy.
Why this matters beyond Cloudflare
This is a tidy example of a good intention causing an outage. Teams were responding to a high profile vulnerability, and speed was reasonable. The failure was in how a change reached production.
The stated remediation list is a useful template:
- Roll out threat response and configuration data with versioning, health checks and quick rollback, the way you roll out code.
- Make break-glass access easy enough to work during a failure.
- Prefer fail-open handling over hard failure where the check is not the thing keeping you safe.
- Lock down risky changes until better mitigation and rollback tools are in place.
Checklist for your own emergency mitigations
- Do not give config a faster path to production than code.
- Test the disable path of every killswitch. Turning a rule off is a change too.
- Define in advance which components fail open and which fail closed, and why.
- Keep a tested rollback that does not depend on the system that is failing.
- During a high profile CVE, budget time for staged rollout. The pressure to be fast is when shortcuts happen.
- Write down who can call a rollback, and make that decision cheap.
For patch pressure from the vulnerability itself, see react server components RCE CVE-2025-55182.
Where Safeguard fits
Safeguard's policies and gates apply staged, reviewable checks to dependency changes, and reachability analysis helps you decide how urgent a CVE is for your own code. A free scan is at gold.safeguard.sh/scan.
Quick check
Was the 5 December 2025 Cloudflare outage an attack?
No. Cloudflare says it was not caused, directly or indirectly, by a cyberattack or malicious activity.
How long did it last?
About 25 minutes of impact, from 08:47 to 09:12 UTC according to Cloudflare.
Sources
Last reviewed: 19 October 2026.
