Cloudflare outage, 5 December 2025

Cloudflare FL1 proxy 500 errors during React CVE mitigation (5 December 2025). The disruption lasted about 25 minutes, according to Cloudflare’s own timeline.

What happened. While raising the WAF body buffer to protect against React Server Components CVE-2025-55182, Cloudflare turned off an internal WAF testing tool via its global configuration system, which has no gradual rollout. On the older FL1 proxy that triggered a Lua bug in the rules module, returning HTTP 500s.

What changes. Cloudflare will apply staged rollouts and versioning to configuration data, streamline break-glass access, and make error handling fail open to a known-good state.

Questions

What caused the Cloudflare outage in December 2025?

While raising the WAF body buffer to protect against React Server Components CVE-2025-55182, Cloudflare turned off an internal WAF testing tool via its global configuration system, which has no gradual rollout.

Which services were affected?

Cloudflare CDN/proxy for customers on FL1 proxy with Managed Ruleset (~28% of HTTP traffic).

Read how shared dependencies spread a failure in why one cloud outage can break unrelated apps, or browse the outage archive.