A WAF killswitch exposed a proxy bug.
While responding to a React Server Components vulnerability, Cloudflare increased WAF body buffering through gradual rollout. A separate global configuration change disabled an internal test tool and triggered a nil execute path in the older FL1 proxy.
Cloudflare was responding to a React Server Components vulnerability by changing how its WAF inspected request bodies. The first change increased the proxy buffer from 128KB to 1MB and used the gradual deployment system. That was the expected high-risk path: customer traffic would be parsed differently, so Cloudflare rolled it out slowly.
The failure came from a second change that looked safer. Cloudflare noticed an internal WAF testing tool did not support the larger buffer and decided to turn that tool off. The tool was not needed for customer traffic, and Cloudflare had a standard killswitch procedure for disabling misbehaving rules. But this switch traveled through the global configuration system, which propagated within seconds rather than through gradual rollout.
In the older FL1 proxy, disabling an execute rule exposed a bug in the rules module. The code skipped evaluation of the sub-ruleset, then later assumed the execute object still existed while processing the overall result. Lua returned a nil-value error, and affected requests received HTTP 500.
Only a subset of customers met the full condition: their sites used the older FL1 proxy and had the Cloudflare Managed Ruleset deployed. Cloudflare reverted the change and traffic recovered within 25 minutes. Internal test infrastructure can share runtime structures with the live request path. Disabling it is still a request-path change, and it needed the same gradual rollout discipline as the buffer-size change it was meant to support.
This system does not perform gradual rollouts// Cloudflare postmortem, December 2025
From the first signal to all-clear in 25m.
A global killswitch removed an execute action the old proxy still expected.
The immediate cause was a global configuration change that disabled an internal WAF rule testing tool. In the older FL1 proxy, that change caused rules module code to reach a path where it attempted to index an `execute` field that was nil, producing Lua exceptions and HTTP 500 responses.
The deeper cause was a split rollout model. The WAF buffer-size increase was using gradual deployment, but the second change used a global configuration system that propagated within seconds and did not perform gradual rollouts. The change looked operationally low-risk because it disabled an internal test tool, but it still modified live request-processing behavior.