Cloudflare/2019-07-02/27 min
The regex that ate every CPU
Jan 2019Dec 2019
Global 502s across ~10% of the web — Discord, Shopify, and Cloudflare's own dashboard went dark.
Lesson
Config changes need the same staged rollout as code. "It's just a rule" is how a global outage starts.
Trigger
A new WAF managed rule for XSS detection was pushed to every edge server worldwide in a single deploy.
Mechanism
The rule contained a regex with catastrophic backtracking. On every HTTP request it drove CPU to 100% across all edge cores at once. A CPU guard that would have caught it had been removed in an earlier refactor.
Interview lens
When asked about safe deploys, cite canary rollouts plus automatic CPU/latency circuit breakers on rule engines.
Recurring patterns
