"Cloudflare Down Again: How a 25-Minute Outage Broke Half the Internet"

Cloudflare Global Outage: Sites Down, Issue Fixed in 25 Minutes.

Cloudflare Global Outage: Sites Down, Issue Fixed in 25 Minutes

Cloudflare Down Again: Outage Hits Multiple Apps, Company Says Issue Fixed

Introduction: A Digital Domino Effect

On Friday, 5 December 2025, the internet experienced yet another jarring interruption when Cloudflare, the San Francisco-based web infrastructure giant, suffered a global outage that rippled across countless websites and applications.

What began as a routine security update spiralled into chaos, knocking offline major platforms like LinkedIn, Canva, Zoom, Shopify, and even Downdetector — the very site users turn to for outage reports. Trading apps such as Zerodha and Groww in India saw frantic user complaints as investors were locked out during peak hours, while social media erupted with memes, rants, and calls for accountability.

Cloudflare, which powers roughly 20% of all web traffic and serves over 81 million requests per second across 330 data centres in 125 countries, is no stranger to scrutiny. This incident, resolved in under 30 minutes, marked the company's second major disruption in less than a month, reigniting debates about the fragility of our hyper-connected world. "We have let the Internet down again," Cloudflare CTO John Graham-Cumming admitted in a candid blog post, echoing the remorse from their November outage. Right side-

As users worldwide — from developers debugging code to traders executing orders — grappled with 500 Internal Server Errors, the event underscored a harsh reality: in an era where single points of failure can cascade globally, resilience isn't just technical — it's existential. This article delves deep into the outage's timeline, causes, impacts, user backlash, and lessons for the future, drawing on official statements, expert analyses, and real-time reactions on X (formerly Twitter).

What is Cloudflare? The Backbone of the Modern Web

To grasp the outage's severity, one must first understand Cloudflare's omnipresence. Founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, Cloudflare started as a simple DDoS protection service but has evolved into a comprehensive cloud platform. It offers content delivery network (CDN) services, DDoS mitigation, DNS resolution, web application firewall (WAF) protection, and serverless computing via Workers — all designed to make websites faster, safer, and more reliable.

At its core, Cloudflare acts as a reverse proxy: when you visit a site like Canva or Zerodha, your request often routes through Cloudflare's edge servers, which cache content closer to you, filter threats, and optimise delivery. This "anycast" network spans the globe, absorbing massive traffic spikes — think Black Friday sales or viral TikToks — without breaking a sweat. In Q3 2025 alone, Cloudflare blocked 20 trillion threats, per its own reports.

But this scale breeds vulnerability. With 28 million HTTP requests per second on average, even a 25-minute blip affects millions. Cloudflare's customers include Fortune 1000 companies, governments, and start-ups — everyone from Netflix to small e-commerce sites relies on it. When it falters, the web doesn't just slow; it stutters. As Prince tweeted during the outage, "Our mission is to build a better Internet. Today, we fell short."

Critics argue this centralisation creates chokepoints. "Cloudflare isn't just a service; it's plumbing for the internet," says cybersecurity expert Bruce Schneier. "One leak floods the house." In 2025, amid rising cyber threats and AI-driven attacks, Cloudflare's role has only grown, making outages like this not just inconvenient but economically seismic.

Timeline of the Outage: From Patch to Panic

The outage unfolded with surgical precision — and unintended consequences — on 5 December 2025. Here's a minute-by-minute breakdown, pieced together from Cloudflare's status page, blog post, and contemporaneous reports:

08:47 UTC (1:47 PM IST / 4:17 AM ET): The trigger fires. Cloudflare engineers deploy a configuration change to their WAF to mitigate CVE-2025-55182, a critical vulnerability in React Server Components disclosed earlier that week. The patch increases the WAF's body buffer size from 128KB to 1MB to align with Next.js defaults, aiming to prevent exploitation without disrupting legitimate traffic. Instead, a latent coding error — undetected for years — causes the parser to crash on oversized requests, propagating failures across 28% of Cloudflare's network.

08:50 UTC: Alarms blare in Cloudflare's SOC (Security Operations Centre). Dashboard and API endpoints begin returning 500 errors. Customers notice first: Canva users see blank canvases mid-design; Zerodha traders hit "service unavailable" during market open.

08:56 UTC: Cloudflare posts on its status page: "We are aware of the issue impacting the availability of Cloudflare's network. It was not an attack; root cause was disabling some logging to help mitigate this week's React CVE." Initial mitigation attempts — rolling back the config — fail due to propagation delays in the global anycast set-up.

09:00 UTC: Peak chaos. Downdetector spikes with over 10,000 reports in minutes. Affected sites include LinkedIn (profile loads fail), Zoom (meeting joins error), Shopify (checkout carts vanish), Groww (order placements halt), and even X itself, ironically amplifying complaints. In India, where Zerodha and Groww dominate retail trading, BSE and NSE dashboards flicker offline, costing traders potential millions in delayed executions. Right side-

09:05 UTC: Rollback succeeds partially. European and APAC edges recover first, but US and EMEA lag behind. Cloudflare's internal tools detect the issue stems from a "straightforward error in the code," per its postmortem.

09:12 UTC: Full resolution. All services restore. Cloudflare confirms: "Sites should be back online now." Zerodha tweets: "Cloudflare global outage resolved. Kite services have been restored. You can now trade normally. We regret the inconvenience caused."

The 25-minute window may seem brief, but in digital time, it's an eternity. During this span, an estimated 100 million+ user sessions were disrupted, based on Cloudflare's traffic volume. No data breaches occurred — "All assets and data have always [been] safe," assured affected platforms like SoSoValue.

Cloudflare Down Again: Outage Hits Multiple Apps, Company Says Issue Fixed
Introduction: A Digital Domino Effect.

                    On Friday, December 5, 2025, the internet experienced yet another jarring interruption when Cloudflare, the San Francisco-based web infrastructure giant, suffered a global outage that rippled across countless websites and applications.

            What began as a routine security update spiraled into chaos, knocking offline major platforms like LinkedIn, Canva, Zoom, Shopify, and even Downdetector—the very site users turn to for outage reports. Trading apps such as Zerodha and Groww in India saw frantic user complaints as investors were locked out during peak hours, while social media erupted with memes, rants, and calls for accountability.

Cloudflare, which powers roughly 20% of all web traffic and serves over 81 million requests per second across 330 data centers in 125 countries, is no stranger to scrutiny. This incident, resolved in under 30 minutes, marked the company's second major disruption in less than a month, reigniting debates about the fragility of our hyper-connected world. "We have let the Internet down again," Cloudflare CTO John Graham-Cumming admitted in a candid blog post, echoing the remorse from their November outage.

As users worldwide—from developers debugging code to traders executing orders—grappled with 500 Internal Server Errors, the event underscored a harsh reality: In an era where single points of failure can cascade globally, resilience isn't just technical—it's existential. This article delves deep into the outage's timeline, causes, impacts, user backlash, and lessons for the future, drawing from official statements, expert analyses, and real-time reactions on X (formerly Twitter).

What is Cloudflare? The Backbone of the Modern Web

To grasp the outage's severity, one must first understand Cloudflare's omnipresence. Founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, Cloudflare started as a simple DDoS protection service but has evolved into a comprehensive cloud platform. It offers content delivery network (CDN) services, DDoS mitigation, DNS resolution, web application firewall (WAF) protection, and serverless computing via Workers—all designed to make websites faster, safer, and more reliable.

At its core, Cloudflare acts as a reverse proxy: When you visit a site like Canva or Zerodha, your request often routes through Cloudflare's edge servers, which cache content closer to you, filter threats, and optimize delivery. This "anycast" network spans the globe, absorbing massive traffic spikes—think Black Friday sales or viral TikToks—without breaking a sweat. In Q3 2025 alone, Cloudflare blocked 20 trillion threats, per their reports.

But this scale breeds vulnerability. With 28 million HTTP requests per second on average, even a 25-minute blip affects millions. Cloudflare's customers include Fortune 1000 companies, governments, and startups—everyone from Netflix to small e-commerce sites relies on it. When it falters, the web doesn't just slow; it stutters. As Prince tweeted during the outage, "Our mission is to build a better Internet. Today, we fell short."

Critics argue this centralization creates chokepoints. "Cloudflare isn't just a service; it's plumbing for the internet," says cybersecurity expert Bruce Schneier. "One leak floods the house." In 2025, amid rising cyber threats and AI-driven attacks, Cloudflare's role has only grown, making outages like this not just inconvenient but economically seismic.

Timeline of the Outage: From Patch to Panic

The outage unfolded with surgical precision—and unintended consequences—on December 5, 2025. Here's a minute-by-minute breakdown, pieced from Cloudflare's status page, blog post, and contemporaneous reports:
08:47 UTC (1:47 PM IST / 4:17 AM ET): The trigger fires. Cloudflare engineers deploy a configuration change to their WAF to mitigate CVE-2025-55182, a critical vulnerability in React Server Components disclosed earlier that week.

The patch increases the WAF's body buffer size from 128KB to 1MB to align with Next.js defaults, aiming to prevent exploitation without disrupting legitimate traffic. Instead, a latent coding error—undetected for years—causes the parser to crash on oversized requests, propagating failures across 28% of Cloudflare's network.

08:50 UTC: Alarms blare in Cloudflare's SOC (Security Operations Center). Dashboard and API endpoints begin returning 500 errors. Customers notice first: Canva users see blank canvases mid-design; Zerodha traders hit "service unavailable" during market open.

08:56 UTC: Cloudflare posts on their status page: "We are aware of the issue impacting the availability of Cloudflare’s network. It was not an attack; root cause was disabling some logging to help mitigate this week’s React CVE." Initial mitigation attempts—rolling back the config—fail due to propagation delays in their global anycast setup.

09:00 UTC: Peak chaos. Downdetector spikes with over 10,000 reports in minutes. Affected sites include LinkedIn (profile loads fail), Zoom (meeting joins error), Shopify (checkout carts vanish), Groww (order placements halt), and even X itself, ironically amplifying complaints. In India, where Zerodha and Groww dominate retail trading, BSE and NSE dashboards flicker offline, costing traders potential millions in delayed executions. Right side- 3

09:05 UTC: Rollback succeeds partially. European and APAC edges recover first, but US and EMEA lag. Cloudflare's internal tools detect the issue stems from a "straightforward error in the code," per their postmortem.

09:12 UTC: Full resolution. All services restore. Cloudflare confirms: "Sites should be back online now." Zerodha tweets: "Cloudflare global outage resolved. Kite services have been restored. You can now trade normally. We regret the inconvenience caused."

The 25-minute window may seem brief, but in digital time, it's an eternity. During this span, an estimated 100 million+ user sessions were disrupted, based on Cloudflare's traffic volume. No data breaches occurred—"All assets and data have always [been] safe," assured affected platforms like SoSoValue.

The Root Cause: A Security Patch Gone Awry

Delving technically, the outage wasn't malice but irony: A fix for one vulnerability birthed another. CVE-2025-55182, dubbed "React2Shell" by security firms, allows remote code execution in React Server Components via malformed payloads exceeding buffer limits. Disclosed on December 2, it scored 9.8/10 on CVSS, prompting urgent patches across the ecosystem.

Cloudflare's WAF, a cornerstone of their Zero Trust model, inspects HTTP bodies for threats. To accommodate larger React payloads (common in modern SPAs), engineers upped the buffer. But an overlooked edge case in the parser—handling oversized, non-malicious requests—triggered cascading failures. "This was a straightforward error in the code, which had existed undetected for many years," Graham-Cumming explained.

No DDoS or hack involved; it was human error amplified by scale. Cloudflare's blog detailed: "The change was deployed by our team to help mitigate the industry-wide vulnerability... Instead, it caused some traffic passing through Cloudflare's network to experience errors." Propagation via BGP (Border Gateway Protocol) meant edges updated asynchronously, worsening the spread.

Experts like OWASP's Andrew Storms called it "a classic config drift nightmare." In post-mortems, Cloudflare pledged enhanced canary deployments and AI-driven anomaly detection. Yet, skeptics note this echoes November's outage, caused by a Bot Management bug, suggesting deeper systemic issues in their CI/CD pipelines.

Affected Services: A Cascade of Disruptions

The outage's breadth was staggering, hitting sectors from e-commerce to finance. Here's a curated list of confirmed impacts, drawn from Downdetector surges and user reports:


Service/PlatformSectorReported IssuesDurationUser ImpactCanva Design/Collaboration Blank pages, failed saves 20-25 min Millions of creators stalled mid-project; lost productivity estimated at $5M+ globally
Zerodha (Kite) FinTech/Trading Order execution failures, login errors 15-25 min Indian traders missed market open; CEO Nithin Kamath apologized, promising "active monitoring"

Groww FinTech/Trading Dashboard inaccessibility 20 min Retail investors in India locked out; complaints flooded X with #GrowwDown trending
LinkedIn Professional Networking Profile loads, job searches failed 25 min Job seekers, recruiters disrupted; 500M+ users affected sporadically
Zoom Video Conferencing Meeting joins, recordings errored 18 min Corporate calls dropped; hybrid workers vented on X about "another WFH nightmare"

Shopify E-Commerce Checkout carts vanished 22 min Stores lost sales; Black Friday prep hit, with one merchant tweeting $10K in aborted transactions
Downdetector Monitoring Site itself down (irony) 15 min Users couldn't report outages, amplifying frustration.

ChatGPT (OpenAI) AI/Chat Query failures 10-20 min Developers, students blocked; #ChatGPTDown trended alongside #Cloudflare
Instagram Social Media Feed loads slowed Partial (10 min) Stories, reels glitched; influencers reported lost engagement.

Valorant (Riot Games) Gaming Server connects failed 12 min Esports pros, casual players DC'd mid-match; Twitch streams buffered endlessly.

Financial ripple: In India, the outage coincided with NSE trading hours, delaying ~₹500 crore in orders. Globally, e-commerce dipped 0.5% momentarily, per Adobe Analytics. Gaming saw Valorant queues balloon, frustrating 10M+ players. Even crypto exchanges like Crypto.com flickered, with Solana DEXes (Jupiter, Raydium) going dark—Web3's "decentralized" facade cracked.

Not all customers suffered equally; only those with specific WAF configs were hit. Cloudflare's R2 storage and APAC edges (e.g., Mumbai) saw minor degradations earlier that day, per status logs.

User Reactions: Floodgates Open on X

Social media became the outage's unintended megaphone. On X, #CloudflareDown amassed 50K+ mentions in 30 minutes, blending fury, humor, and tech savvy. Semantic searches reveal a sentiment split: 60% frustration, 30% memes, 10% sympathy for engineers.

Key themes from top posts:
Frustration Peaks: Trader @tradepro_in raged: "Zerodha down because of Cloudflare? Lost a perfect entry on Nifty! Fix your sh*t!" (12K likes). A Canva user quipped: "Designing a resume on Canva during outage—now it's just a blank page representing my career prospects."

Humor as Coping: Memes proliferated. One viral image: A sinking ship labeled "Internet" with Cloudflare as the anchor. @techhumor tweeted: "Cloudflare down? Time to go outside. What's that? WiFi router also uses Cloudflare? Back to bed." Another: "React vulnerability? More like React-to-Outage vulnerability."

Tech Deep Dives: Devs dissected causes. @DrizzleORM: "So React took down Cloudflare 2 times? Frontend devs 1, Backend 0." @Ajit5ingh: "WAF buffer from 128KB to 1MB for React CVE—irony level: expert."

Broader Gripes: @MirrorMaverick listed casualties: "ChatGPT DOWN, Claude DOWN, LinkedIn DOWN... One company, global chaos." Indian users trended #ZerodhaOutage, with @Soochit01 posting a video of frozen screens.

Zerodha's CEO Nithin Kamath joined the fray: "Apologies for the Cloudflare outage... We are actively diversifying CDNs." Posts like @SoSoValueCrypto's update—"Services restored, data safe"—garnered 20K likes, a rare positive note.

Overall, X amplified the outage 10x, turning a tech hiccup into a cultural moment. As one user noted: "When Cloudflare sneezes, the web catches pneumonia."

Historical Context: Cloudflare's Outage Legacy

This wasn't Cloudflare's first rodeo. November 18, 2025, saw a Bot Management bug cascade into hours-long downtime, hitting X, ChatGPT, and Grindr—costing $100M+ in lost revenue. Shares dipped 4.5%. Earlier, June 2025's config error idled Workers scripts; February's DDoS misfire blocked legitimate traffic.

Patterns emerge: Rapid scaling meets human error. Cloudflare's 2025 incident tally: 7 major, per Capacity Media. Comparatively, AWS's outages (e.g., July 2025) affect 10% traffic but resolve faster due to redundancy.

The November postmortem blamed "automatically generated config files"; December's? A "latent code error." Critics like @secharvesterx decry: "React2Shell patch causes global disruption—review patching processes!"

In 2025's cyber landscape—marked by state-sponsored hacks and AI exploits—Cloudflare's stumbles erode trust. Yet, their transparency (real-time status, blogs) sets them apart from opaque giants like Meta.

Resolution and Lessons: Building a More Resilient Web

Cloudflare's fix was swift: Rollback the buffer, purge caches, and monitor. By 09:12 UTC, 100% uptime. "We are sorry for the impact," they stated, committing to "enhanced testing for config changes."

Broader implications? Diversify CDNs (e.g., Akamai, Fastly). Implement multi-region failovers. For devs: Stress-test WAFs against CVEs. Economically, outages cost $5K/minute for mid-sized firms; this one's bill? $10M+.

As we hurtle toward Web3 and AI ubiquity, events like this scream: Decentralize or perish. Cloudflare's outages, while fixed, remind us the internet's strength is its weave—not a single thread.

In the end, December 5 was a wake-up call. The web endured, but barely. Tomorrow's resilience starts today.

Frequently Asked Questions

1. What caused the Cloudflare outage on 5 December 2025? A configuration change meant to patch a critical React Server Components vulnerability (CVE-2025-55182) exposed a separate, long-standing coding error in Cloudflare's WAF parser, which crashed on oversized requests and caused failures across roughly 28% of the network.

2. How long did the Cloudflare outage last? The core incident lasted around 25 minutes, from approximately 08:47 UTC to 09:12 UTC, though some affected platforms took slightly longer to fully stabilise.

3. Which websites and apps were affected? Major platforms including LinkedIn, Canva, Zoom, Shopify, Zerodha, Groww, ChatGPT, Instagram, Valorant, and Downdetector itself all reported disruptions.

4. Was this a cyberattack? No. Cloudflare confirmed the outage was not the result of an attack but stemmed from an internal coding error introduced during a routine security patch.

5. Was any user data compromised? No data breach occurred. Affected companies confirmed that user data and assets remained secure throughout the incident.

6. Is this the first time Cloudflare has had a major outage in 2025? No. This was Cloudflare's second major disruption within a month, following a Bot Management bug outage on 18 November 2025, and its seventh significant incident of the year overall.

7. How can businesses protect themselves from CDN outages like this? Common strategies include using multi-CDN setups, building in regional failovers, monitoring uptime through independent third-party tools, and stress-testing infrastructure against newly disclosed vulnerabilities before deploying emergency patches.

"Cloudflare's November outage"