OVER roughly two weeks in August 2026, developers experienced intermittent 502 and 503 errors when pip attempted to download packages from files.pythonhosted[.]org, causing builds across many Python projects to fail. The incident was clarified in an official PyPI post by Mike Fiedler, who noted that two distinct CDN-related problems were involved, both subsequently resolved. Downloads returned to full function on 28 August.
Evidence from user reports proved crucial: one report helped isolate the issue to a single cache node, and x-served-by headers confirmed the node at fault.
The investigation identified two separate problems. First, a misconfiguration within Fastly’s network occurred during a canary deployment, triggering 502 responses at one cache node after a partial rollback left the caching configuration in place while the routing layer remained unchanged.
Second, issues closer to PyPI’s own setup included several Fastly configuration bugs affecting origin fallback and range request handling: a faulty fallback from Backblaze B2 to Amazon S3 could cause Fastly to generate its own error, a 501 error surfaced for suffix range requests used by some installers, and a URL normalisation check ran before cleaning the URL, allowing a bad response to be cached and repeatedly served.
The Fastly team subsequently deployed patches, with recovery beginning 20 August and a final fix for the Canary bug and traffic exclusion completed on 28 August. The episode highlighted the Python ecosystem’s reliance on reliable file hosting and the ripple effects of CDN and configuration issues on software supply chains.