When millions of users woke up on Friday morning expecting business as usual, they instead ran into a wall of “HTTP 500” errors across some of the world’s biggest online platforms. From e-commerce giants to medical booking systems and video-conferencing tools, the web felt noticeably broken.

The cause? A sudden and massive Cloudflare outage.
The company—responsible for handling roughly 20% of the world’s internet traffic—has now released a detailed incident report explaining exactly what went wrong.

Here’s the full breakdown, rewritten clearly and optimized for readers in the US.

A Short Outage With Huge Impact

At 9:47 a.m. CET, Cloudflare’s servers began throwing widespread HTTP 500 errors. Although the outage lasted only 25 minutes, ending at 10:12 a.m., the disruption was significant. Cloudflare estimates that 28% of its total HTTP traffic was affected during the event.

The incident didn’t take websites offline in the traditional sense. Instead, it broke the connection between users and servers. Any website relying on Cloudflare’s older FL1 proxy architecture combined with its Web Application Firewall (WAF) became inaccessible. The sites themselves were running normally—users simply couldn’t reach them.

Some of the services affected included:

• Vinted, Decathlon, Carrefour (e-commerce)
• Zoom (video conferencing)
• Doctolib (medical booking)
• Coinbase, Kraken (crypto platforms)
• And in a moment of pure irony: Downdetector, the website that reports outages, was also down.

The Culprit: A Security Patch Gone Wrong

This outage wasn’t caused by a cyberattack, nor by malicious traffic. Instead, it stemmed from Cloudflare’s attempt to protect customers from a newly discovered critical vulnerability.

Earlier in the week, security researchers identified a major flaw in React Server Components. It was named React2Shell and catalogued as CVE-2025-55182.

To defend platforms built with React and Next.js, Cloudflare modified its WAF by expanding the memory buffer used to inspect incoming HTTP requests. The buffer size jumped from 128 KB to 1 MB, matching Next.js’s maximum default limit.

The update rolled out gradually, just like any normal Cloudflare infrastructure change. But during the deployment, engineers realized an internal tool used to validate WAF rules couldn’t handle the larger buffer. Because this tool wasn’t directly tied to customer traffic, Cloudflare temporarily disabled it.

That decision triggered the disaster.

Unlike the controlled rollout of the buffer increase, the deactivation of this internal tool propagated instantly across Cloudflare’s entire global network, thanks to its universal configuration system. A hidden bug—previously dormant—activated immediately, causing the chain reaction of HTTP 500 errors that users experienced worldwide.

The full technical analysis is available in Cloudflare’s official incident report for those who want the deep dive.

Two Outages in Three Weeks

This wasn’t an isolated incident. Just three weeks earlier, on November 18, 2025, Cloudflare suffered a much longer six-hour outage. That issue was caused by an oversized anti-bot configuration file that overwhelmed part of their system.

After the November outage, Cloudflare publicly committed to major reforms:

• More robust deployment safeguards
• Universal gradual rollouts
• Faster and safer rollback procedures
• Architecture changes ensuring traffic continues to flow even when internal systems fail

However, those improvements are still in progress. Cloudflare admitted this in its report, stating:
“We know it’s disappointing that this work isn’t complete yet. It remains our top priority across the entire organization.”

Until the new protections are fully implemented, Cloudflare has frozen all configuration changes across its network.

Conclusion:

The December outage highlights just how dependent the modern web is on Cloudflare’s infrastructure. A single misconfiguration—triggered by a well-intentioned security update—was enough to briefly destabilize major online services worldwide.

While Cloudflare is working on stronger safeguards, these back-to-back incidents are a clear reminder of how fragile global internet infrastructure can be. The company’s promised improvements will be crucial, not only for Cloudflare’s customers but for the millions of users who rely on its network every day.

If Cloudflare succeeds, the next attempted fix won’t bring down nearly a third of the web.