Cloudflare outage, 5 December 2025

Cloudflare FL1 proxy 500 errors during React CVE mitigation (5 December 2025). The disruption lasted about 25 minutes, according to Cloudflare’s own timeline. It began at 08:47 UTC and was resolved at 09:12 UTC. While raising the WAF body buffer to protect against React Server Components CVE-2025-55182, Cloudflare turned off an internal WAF testing tool via its global configuration system, which has no gradual rollout.

What happened next. On the older FL1 proxy that triggered a Lua bug in the rules module, returning HTTP 500s.

What changes. Cloudflare will apply staged rollouts and versioning to configuration data, streamline break-glass access, and make error handling fail open to a known-good state.

Questions

What caused the Cloudflare outage in December 2025?

While raising the WAF body buffer to protect against React Server Components CVE-2025-55182, Cloudflare turned off an internal WAF testing tool via its global configuration system, which has no gradual rollout.

Which services were affected?

Cloudflare CDN/proxy for customers on FL1 proxy with Managed Ruleset (~28% of HTTP traffic).

Read how shared dependencies spread a failure in why one cloud outage can break unrelated apps, or browse the outage archive.