Cloudflare outage on December 5, 2025

On Dec 5, 2025, Cloudflare experienced a ~25-minute outage (08:47–09:12 UTC) affecting about 28% of HTTP traffic, triggered by a global configuration change that disabled an internal WAF testing tool while rolling out larger request-body buffers to help mitigate an industry-wide React Server Components vulnerability (CVE-2025-55182). A bug in the legacy FL1 proxy’s rulesets logic caused errors when a killswitch skipped an execute action, resulting in HTTP 500s for customers on FL1 with the Managed Ruleset; others, including the China network, were unaffected. The change was reverted to restore service, and Cloudflare outlined ongoing resilience work (enhanced rollouts/versioning, streamlined break-glass, and fail-open error handling) alongside a temporary change freeze.