Cloudflare Outage Technical Analysis: The Lua Bug That Took Down 28% of the Internet

25 Minutes of "500 Internal Server Error"

At 08:47 UTC on December 5, 2025, a large part of the internet ground to a halt. For about 25 minutes, users around the world trying to reach services protected by Cloudflare got HTTP 500 errors. The outage hit roughly 28% of all HTTP traffic handled by the CDN giant. As we reported earlier, this was not Cloudflare's only major incident that December.

One point is worth making up front: this was not a cyberattack. The outage was caused by a configuration change that was supposed to... improve security. Cloudflare has a long history of high-profile outages. The November incident is a recent reminder of how fragile modern internet infrastructure can be.

Background: Patching a React Vulnerability (CVE-2025-55182)

It all started with good intentions. Cloudflare was rolling out mitigations for a critical vulnerability in React Server Components (CVE-2025-55182), which we covered in detail in our article on React2Shell. To reliably detect malicious payloads targeting this flaw, its engineers had to increase the content inspection buffer in their Web Application Firewall (WAF) from the default 128KB to 1MB, which matches the limit used by Next.js.

Sequence of Events: Deployment and Rollback

The buffer size change was being rolled out as a gradual deployment. During the rollout, however, the team noticed that an internal WAF testing tool could not handle the larger buffer. Because the tool played no role in serving customer traffic, they decided to turn it off.

That decision set off the outage. The testing tool was switched off through the global configuration system, which pushes changes to the entire server fleet instantly. Code changes, by contrast, are rolled out slowly and in stages.

A Logic Error in Lua

The change reached servers still running the older version of Cloudflare's proxy (FL1), which is built on NGINX and Lua. Disabling the test rule with a "killswitch" action caused the rules engine to skip a section of code, but logic further down still tried to use that section's results.

The result was a textbook error:

[lua] ... attempt to index field 'execute' (a nil value)

Put simply, the code expected a rule_result.execute object that did not exist, because the rule had been "killed" before it ran. This unhandled access on a nil (null) value produced a wave of 500 errors for every customer using Managed Rulesets on the FL1 proxy.

Lessons Learned and a Future in Rust

Cloudflare quickly identified the problem and rolled back the change at 09:12 UTC, restoring full network service.

Notably, Cloudflare's newer proxy (FL2), written in Rust, was not affected by the bug at all. Rust's strong type system made this kind of error impossible at compile time. The company has announced it will speed up its migration to Rust and introduce "fail-open" mechanisms. With fail-open, a configuration error lets traffic through (possibly without scanning) instead of blocking it entirely.

The irony is hard to miss. An attempt to defend against one vulnerability, in React, caused a global outage through a bug that had gone unnoticed in the code for years.

Aleksander

Sources

Cloudflare Blog: Cloudflare outage on December 5, 2025