How a React useEffect Hook Brought Down Cloudflare: A Critical Frontend Development Lesson

In September 2025, one of the internet’s most critical infrastructure companies experienced an outage that wasn’t caused by sophisticated hackers, massive DDoS attacks, or server failures. Instead, Cloudflare—the company that routinely deflects terabit-scale attacks and keeps millions of websites online—was brought down by a fundamental React programming mistake that many junior developers learn to avoid in their first week.

The Shocking Reality

The irony is almost comedic: Cloudflare, which has successfully defended against 7.3 terabit per second DDoS attacks, was taken offline by a React useEffect hook with an improper dependency array. This wasn’t some elite squad of nation-state hackers—it was a classic frontend development anti-pattern that created an infinite loop of API calls.

Source: The technical details and timeline referenced in this article are based on Cloudflare’s official incident report: “A deep dive into Cloudflare’s September 12, 2025 dashboard and API outage”

Understanding the Technical Mistake

The Problematic Code Pattern

The issue stemmed from this common React pattern:

// Simplified version of the problematic code
function Dashboard() {
  const params = { // This object is recreated on every render
    organizationId: user.orgId,
    filters: currentFilters
  };

  useEffect(() => {
    // This function calls the API
    fetchDashboardData(params);
  }, [params]); // ← The problem is here

  return "Dashboard rendered";
}

Why This Creates an Infinite Loop

The useEffect hook compares dependencies using shallow comparison. Here’s what happens:

1. Component renders → Creates new params object
2. useEffect runs → Fetches data, potentially updating state
3. State update triggers re-render → Creates another new params object
4. React compares dependencies → params reference has changed
5. useEffect runs again → Back to step 2, creating an infinite loop

Why is the params object recreated every time?

In JavaScript, object literals like { organizationId: user.orgId, filters: currentFilters } create a new object in memory each time they’re executed. Even if the values inside are identical, the object reference is different.

// Every time this function runs, a NEW object is created
const params = { organizationId: user.orgId, filters: currentFilters };

// This is equivalent to:
const params = new Object();
params.organizationId = user.orgId;
params.filters = currentFilters;

Memory Reference Comparison:

// These objects have the same content but different memory references
const obj1 = { name: "John" };
const obj2 = { name: "John" };
console.log(obj1 === obj2); // false - different memory locations

// Only same reference returns true
const obj3 = obj1;
console.log(obj1 === obj3); // true - same memory reference

React’s useEffect uses Object.is() (similar to ===) to compare dependencies. Since a new params object is created on every render, React thinks the dependency has changed, even though the values inside might be identical.

Even though the params object contains the same values, React sees it as “different” because it’s a new object reference in memory each time.

The Scale of the Problem

According to Cloudflare’s incident report, this simple mistake resulted in:

• Thousands of API calls per minute from a single dashboard session
• Complete API overload when multiplied across all users
• Cascading failures throughout their infrastructure
• Global outage affecting millions of websites

The Correct Solutions

Solution 1: Memoize the Dependency

import { useMemo, useEffect } from 'react';

function Dashboard() {
  const params = useMemo(() => ({
    organizationId: user.orgId,
    filters: currentFilters
  }), [user.orgId, currentFilters]); // Only recreate when these change

  useEffect(() => {
    fetchDashboardData(params);
  }, [params]);

  return "Dashboard rendered";
}

Solution 2: Separate the Dependencies

function Dashboard() {
  useEffect(() => {
    const params = {
      organizationId: user.orgId,
      filters: currentFilters
    };
    fetchDashboardData(params);
  }, [user.orgId, currentFilters]); // Direct dependencies

  return "Dashboard rendered";
}

Solution 3: Use useCallback for Functions

import { useCallback, useEffect } from 'react';

function Dashboard() {
  const fetchData = useCallback(async () => {
    const params = {
      organizationId: user.orgId,
      filters: currentFilters
    };
    await fetchDashboardData(params);
  }, [user.orgId, currentFilters]);

  useEffect(() => {
    fetchData();
  }, [fetchData]);

  return "Dashboard rendered";
}

The Broader Engineering Lessons

1. Code Review Failures

How did this obvious infinite loop make it to production? The incident highlights several engineering process failures:

• Local development testing should have immediately shown thousands of network requests
• Code review processes should catch fundamental React anti-patterns
• Staging environments should replicate production load patterns
• Monitoring systems should alert on unusual API usage patterns

2. The Thundering Herd Problem

When Cloudflare attempted to fix the issue by clearing user sessions, they inadvertently created a “thundering herd” problem—millions of users simultaneously re-authenticating when the service came back online, causing a second outage.

3. Rate Limiting and Circuit Breakers

The incident revealed that Cloudflare’s internal APIs lacked proper:

• Rate limiting to prevent abuse
• Circuit breakers to fail gracefully under load
• Automatic rollback mechanisms for problematic deployments

Prevention Strategies

For Developers

1. Use ESLint rules like exhaustive-deps to catch dependency issues
2. Install React Developer Tools to monitor component re-renders
3. Add network monitoring to catch unusual API patterns during development
4. Practice defensive programming with proper error boundaries

For Engineering Teams

1. Implement gradual rollouts instead of instant global deployments
2. Set up proper monitoring for API usage patterns
3. Establish code review checklists for common React anti-patterns
4. Create load testing environments that simulate real usage

Essential ESLint Configuration

{
  "extends": ["plugin:react-hooks/recommended"],
  "rules": {
    "react-hooks/exhaustive-deps": "error"
  }
}

A Critical Learning Moment

This incident serves as a powerful reminder of how fundamental programming mistakes can have massive global impacts. The outage affected millions of websites and countless businesses worldwide, all from a mistake that could have been caught with proper tooling and processes.

As ThePrimeagen, a well-renowned and famous tech YouTuber, commented on the incident: “We’ve all made this mistake—I’m just happy I caught mine in development, not production.”

Key Takeaways

1. Fundamental knowledge matters — Even at enterprise scale, basic programming principles are critical
2. Tooling is essential — ESLint, React DevTools, and proper monitoring prevent these issues
3. Process failures compound technical failures — Multiple safety nets failed simultaneously
4. Gradual deployment saves lives — Instant global rollouts are dangerous for critical infrastructure
5. React’s power requires responsibility — The framework’s flexibility demands disciplined development practices

Moving Forward

Cloudflare has since implemented:

• Argo Rollouts for automatic deployment rollbacks
• Enhanced monitoring for API usage patterns
• Better rate limiting and circuit breaker patterns
• Improved code review processes for frontend changes

The incident serves as a powerful reminder that in our interconnected world, even the smallest code changes can have massive global impacts. Whether you’re building a simple website or managing critical infrastructure, understanding React fundamentals and implementing proper engineering processes isn’t just good practice—it’s essential for internet stability.

The next time you write a useEffect hook, remember: Cloudflare’s engineers are probably double-checking their dependency arrays too.