Cloudflare chief executive Matthew Prince confirmed that a major internal software failure caused the global outage that disrupted access to platforms such as ChatGPT, X, Spotify, and YouTube on 18 November 2025. He further explained that the hours-long incident began when a database change unexpectedly altered a core configuration file used across its network.
The disruption started around 11:20 UTC when proxy machines handling vast amounts of internet traffic began returning widespread HTTP 5xx errors. The issue rapidly spread worldwide because Cloudflare provides various security, performance, and content delivery services to thousands of companies and their platforms operating in multiple regions.
Engineers traced the malfunction to the Bot Management system. This system is responsible for assigning identification scores to incoming requests. A database permission change at 11:05 UTC created duplicate metadata entries, causing the generated feature file to exceed expected limits and trigger an unhandled panic in the updated proxy engine.
Cloudflare said the inflated feature file overwhelmed memory allocations within the FL2 proxy module, which used preset limits for acceptable feature counts. The module crashed when it loaded the malformed file, producing the cascading server errors that affected customer websites, the dashboard, and several internal authentication services.
The outage caused intermittent failures because the problematic file regenerated every 5 minutes across different database shards. This inconsistency complicated early diagnosis and initially led engineers to suspect a potential coordinated attack. Mitigation became possible only after staff confirmed the abnormal file size and halted its propagation.
Cloudflare deployed a stable configuration file, restarted impacted services, and temporarily bypassed parts of its proxy infrastructure to restore access to products such as Workers KV and Access. The company successfully resolved the main disruption by 14:30 UTC and restored full operational stability by approximately 17:06 UTC.
Prince apologized for the incident and called the outage unacceptable for an internet infrastructure provider. The announced plans to strengthen configuration safeguards, expand global kill-switch capabilities, and redesign error-handling processes to prevent similar failures across its platform, which manages traffic for a substantial portion of the web.
FURTHER READING AND REFERENCE
- Prince, M. 18 November 2025. “Cloudflare Outage on November 18, 2025.” The Cloudflare Blog. Cloudflare. Available online