Cloudflare blames today's outage on React2Shell mitigations

Cloudflare deployed emergency mitigations for a critical React Server Components RCE (CVE-2025-55182, "React2Shell"), which inadvertently caused a widespread outage impacting roughly 28% of HTTP traffic; the flaw affects several React packages and specific React versions. Security researchers report proof-of-concept exploits are available and multiple China-linked groups (including Earth Lamia and Jackpot Panda) have begun exploiting the vulnerability in the wild, prompting warnings from organizations such as NHS England CSOC.