Cloudflare Outage Caused by React Server Components Vulnerability

On a recent day, Cloudflare faced a significant outage that led to websites and online platforms worldwide displaying a “500 Internal Server Error” message. The root cause of this outage was attributed to emergency mitigations implemented by Cloudflare to address a critical remote code execution vulnerability in React Server Components, which has been actively exploited in cyber attacks.

According to Cloudflare CTO Dane Knecht, the issue was not a result of a cyber attack on Cloudflare’s systems but rather changes made to body parsing logic in response to a vulnerability in React Server Components. Approximately 28% of all HTTP traffic served by Cloudflare was affected by this incident.

The vulnerability, tracked as CVE-2025-55182 and named React2Shell, impacts React and dependent React frameworks such as Next.js, React Router, Waku, and others. Attackers can exploit this flaw in React Server Components to achieve remote code execution by sending malicious HTTP requests to React Server Function endpoints.

While the vulnerability affects specific versions of React released in the past year, security researchers have noted ongoing exploitation of React2Shell by China-linked hacking groups, including Earth Lamia and Jackpot Panda. The NHS England National CSOC has also warned of the likelihood of continued successful exploitation in the wild.

Cloudflare’s History of Outages

Cloudflare has experienced previous outages, including one in June that impacted Access authentication and Zero Trust WARP connectivity. CEO Matthew Prince described it as the worst outage since 2019. Another outage in the past month affected Cloudflare’s Global Network for almost 6 hours and also impacted Google Cloud’s infrastructure.

It is essential for organizations to stay vigilant against vulnerabilities like React2Shell and implement robust security measures to protect their systems from potential cyber attacks.

Update December 05, 11:38 EST: The article has been revised based on a post-mortem shared by Cloudflare CTO Dane Knecht.