On 18 November 2025, Cloudflare experienced one of its most disruptive outages since 2019, causing millions of websites to show 5xx errors and making large parts of the Internet briefly inaccessible.
🔍 What Went Wrong
Despite early suspicion of a major DDoS attack, Cloudflare confirmed the issue was entirely internal:
✔ A database permission change
→ produced duplicate entries
→ doubled the size of a Bot Management “feature file”
→ exceeded a memory limit inside Cloudflare’s core proxy.
When the oversized file propagated globally, proxies crashed — causing massive traffic failures across Cloudflare’s network.
🌐 How It Looked to Users
- Websites behind Cloudflare returned 5xx errors
- Cloudflare’s own status page appeared down (a coincidence)
- Login sessions and internal APIs failed
- Workers KV and Cloudflare Access were partially disrupted
🔁 Why It Was Hard to Diagnose
The system alternated between working and failing every few minutes as different database shards generated “good” or “bad” versions of the feature file.
This intermittent failure appeared to be the result of an active attack.
🛠 How Cloudflare Fixed It
By 14:30 UTC, Cloudflare:
- Stopped distributing the bad config file
- Manually deployed a known-good file
- Restarted core proxy systems
- Scaled up capacity to handle traffic surges after recovery
All systems were fully restored by 17:06 UTC.
📌 Cloudflare’s Response
Cloudflare has openly acknowledged this as an unacceptable failure, promising:
- Stricter validation of internal config files
- More kill switches and fail-safes
- Better proxy module error handling
- Improved ClickHouse permission rollout processes
🧠 Why This Matters
Cloudflare sits at the center of global Internet infrastructure.
When it fails — even for minutes — the ripple effect is enormous.
Incidents like this reinforce the importance of:
- Defense-in-depth, even against internal changes
- Zero-trust architecture inside critical infrastructure
- Global kill switches for high-impact systems
- Configuration file sanitization, just as with user input
