Cloudflare experienced yet another outage, just weeks after a global outage affected services such as ChatGPT, X, and even SDxCentral.

This latest outage was much shorter than the previous incident, but still saw platforms including Substack, Canva, and X (formerly Twitter) affected. Even the outage analysis platform Down Detector went down for a time.

The once-present error message on Cloudflare’s System Status page has since disappeared, though maintenance is currently underway across several of its sites, including Detroit, Chicago, and Bogotá, Colombia.

The issues affected Cloudflare Dashboard and related APIs in the early hours of December 5, but a fix is believed to have been put in place, with the vendor monitoring the results.

An earlier message on Cloudflare’s System Status page stated that an issue with how Cloudflare's Web Application Firewall parses requests had caused its network to be unavailable.

Cloudflare confirmed that this latest incident "was not an attack" and that the change was deployed by its team to "mitigate the industry-wide vulnerability disclosed this week in React Server Components.”

The vulnerability in question was published on November 29, with an issue in React allowing unauthenticated users to potentially execute remote code based on how React decodes payloads sent to React Server Function endpoints.

React issued a fix and urged users to update, as even if their application doesn’t implement any React Server Function endpoints, it may still have been vulnerable.

Two weeks, two outages

In a blog post detailing the incident, CTO Dane Knecht said: “Any outage of our systems is unacceptable, and we know we have let the Internet down again following the incident on November 18. We will be publishing details next week about the work we are doing to stop these types of incidents from occurring.”

Knecht revealed that this latest incident saw approximately 28% of all HTTP traffic served by Cloudflare affected as a result of the botched attempt to patch the React vulnerability.

The outage occurred because Cloudflare attempted to disable an internal WAF testing tool using a killswitch as part of a rollout to patch a React vulnerability (CVE-2025-55182).

As detailed in Cloudflare’s blog, the outage occurred after the vendor attempted to disable an internal WAF testing tool using a killswitch as part of its attempts to patch the React vulnerability.

Applying the killswitch to a rule with an “execute” action triggered a long-undetected bug in the Lua code of their older FL1 proxy. This bug caused a null value lookup error, resulting in HTTP 500 errors for traffic served by the affected proxy version.

“We have used this killswitch system on a number of occasions in the past to mitigate incidents and have a well-defined Standard Operating Procedure, which was followed in this incident. However, we have never before applied a killswitch to a rule with an action of ‘execute,’” Knecht explained.

The null value lookup error stemmed from a long-undetected bug in the Lua code: when the killswitch was applied, it correctly skipped the ‘execute’ action, but the subsequent code still expected the associated object to exist, and attempting to look up a value in the now-missing object caused the failure.

“This is a straightforward error in the code, which had existed undetected for many years. This type of code error is prevented by languages with strong type systems. In our replacement for this code in our new FL2 proxy, which is written in Rust, the error did not occur,” the CTO added.

The December 5 outage was the second outage in as many weeks for Cloudflare, in which a deployment it made to mitigate a security issue resulted in errors across its network.

Knecht used his blog post for this latest incident to stress that in the time since the November 18 outage, Cloudflare has moved to speak with “hundreds of customers” to outline plans to prevent single updates from causing a similar widespread impact.

“We believe these changes would have helped prevent the impact of today’s incident, but, unfortunately, we have not finished deploying them yet,” he said. “We know it is disappointing that this work has not been completed yet. It remains our first priority across the organization.”

Among the planned changes, Cloudflare plans to change the way it deploys software with strict health validation, introducing remedies like quick rollback capabilities.

The vendor is also planning to introduce methods to replace incorrectly applied hard-fail logic – so if a configuration file is corrupt or out of range, the system will log the error and “default to a known-good state.”

“These kinds of incidents, and how closely they are clustered together, are not acceptable for a network like ours,” Knecht concluded. “On behalf of the team at Cloudflare, we want to apologize for the impact and pain this has caused again to our customers and the Internet as a whole.”