[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_26":27,"_28":29,"_30":12,"_31":12,"_32":12,"_33":12,"_34":12,"_35":12,"_36":37},"routes/canvas.shared.$sharedTextdocId",{"_9":10,"_11":12},"sharedTextdoc",{"_13":14,"_15":-7,"_16":17,"_18":19,"_20":21,"_22":23,"_24":12,"_25":12},"isAuthenticated",false,"sharedTextdocId","6923a535e924819189305fc37fb831ce","versionInt","title","Cloudflare Outage — Timeline Website","type","code/react","content","import React from \"react\";\nimport { motion } from \"framer-motion\";\n\nexport default function CloudflareOutageTimeline() {\n const events = [\n {\n time: \"11:20 UTC\",\n title: \"Outage begins\",\n description:\n \"Edge servers begin returning HTTP 5xx responses; error metrics spike. Initial internal suspicion: possible DDoS.\",\n },\n {\n time: \"11:20–12:00 UTC\",\n title: \"False lead\",\n description:\n \"Teams search for external causes. Traffic looks suspicious but no external root cause is found; errors continue to grow.\",\n },\n {\n time: \"12:00–13:00 UTC\",\n title: \"Narrowing investigation\",\n description:\n \"Engineers identify a proxy component tied to Bot Management reading an unexpectedly large configuration file; the module starts failing.\",\n },\n {\n time: \"13:05 UTC\",\n title: \"First mitigation\",\n description:\n \"A bypass for Workers KV and Access is enabled to reduce load on the damaged module. Situation improves but is not fully resolved.\",\n },\n {\n time: \"13:00–14:00 UTC\",\n title: \"Root cause found\",\n description:\n \"A change in ClickHouse permissions caused SQL queries to return duplicate rows. Generated feature files ballooned in size, exceeding memory preallocation limits and causing proxy panics.\",\n },\n {\n time: \"14:30 UTC\",\n title: \"Fix deployed\",\n description:\n \"The bad feature file distribution is stopped and a correct version is deployed. Edge servers begin recovery.\",\n },\n {\n time: \"14:30–16:00 UTC\",\n title: \"Gradual stabilization\",\n description:\n \"Modules stop crashing and error rates decline toward normal levels.\",\n },\n {\n time: \"17:06 UTC\",\n title: \"Full recovery\",\n description:\n \"Cloudflare announces all systems are operating normally: Dashboard, Workers, Access and CDN restored.\",\n },\n ];\n\n return (\n

Cloudflare — Outage on November 18, 2025

A concise timeline and technical summary of the incident: what happened, why it happened, and what mitigations were implemented.

\n\n

Timeline

\n\n

\n {events.map((e, idx) => (\n \n

{e.time}

{e.title}

{e.description}

\n \n ))}\n

\n\n

Technical summary

\n Root cause: A permissions change in a ClickHouse table caused SQL queries to return duplicate rows. Those duplicates were included in a generated feature file for Bot Management, which grew far beyond expected size.\n
\n Failure mode: The proxy component used strict memory preallocation. When the feature file size exceeded limits the process panicked, restarting and returning HTTP 5xx.\n
\n Systems affected: CDN edge, Bot Management, Workers KV, Access, and Turnstile-based logins in Dashboard — all relied on the impacted proxy path.\n
\n Mitigations taken: Bypasses for Workers KV and Access, rollback of the bad feature file, and deployment of validation + stronger safeguards.\n

\n\n

Key takeaways

Internal configuration issues can be as disruptive as external attacks.
Validate and limit generated configuration files before deploying to edge.\n
Have global feature kill switches and robust fallbacks for critical proxies.
Test permission changes in a staging pipeline to avoid unexpected duplicates from DB queries.

\n\n

Options

\n \n Download timeline (MD)\n \n {\n navigator.clipboard?.writeText(document.documentElement.innerText || \"\");\n alert(\"Page text copied to clipboard\");\n }}\n >\n Copy text\n \n

\n\n \n

\n );\n}\n","access","public","isModerationBlocked","isAnonifyApiKeyDetected","dd",{"_38":39,"_40":41},"disablePrefetch",true,"shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",37],"traceId","6680525840555206549","traceTime",1779640260305]