Cloudflare Outage Caused by React2Shell Mitigations

Cloudflare says the outage was linked to mitigations for the critical React vulnerability known as React2Shell, officially tracked as CVE-2025-55182, exploited in the wild by Chinese and other threat actors. According to SecurityWeek, major firms including Google Cloud and AWS, alongside Cloudflare itself, moved quickly to roll out web application firewall protections after the vulnerability’s public disclosure.

Cloudflare began investigating issues on 5 December 2025 at 08:56 UTC and deployed a fix within about half an hour, but several major services such as Zoom, LinkedIn, Coinbase, DoorDash and Canva reported outages in the interim. The company said the disruption was caused by a change implemented to help mitigate the industry-wide vulnerability, specifically in how Cloudflare’s Web Application Firewall parses requests, and noted this was not an attack. This is noted as Cloudflare’s second significant outage in less than a month, with the mid‑November incident described as not being cyberattack‑related.