Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 14 submissions in the queue.

Submission Preview

Link to Story

Cloudflare DDoSed Itself With React useEffect Hook Blunder

Accepted submission by upstart at 2025-09-23 23:30:02
News

upstart [soylentnews.org] writes:

████ # This file was generated bot-o-matically! Edit at your own risk. ████

Cloudflare DDoSed itself with React useEffect hook blunder [theregister.com]:

Cloudflare has confessed to a coding error using a React useEffect hook, notorious for being problematic if not handled carefully, that caused an outage for the platform's dashboard and many of its APIs.

The outage was on September 12, lasted for over an hour, and was triggered by a bug in the dashboard, which caused "repeated, unnecessary calls to the Tenant Service API," according to VP of engineering Tom Lianza [cloudflare.com]. This API is part of the API request authorization logic and therefore affected other APIs.

The cause was hard to troubleshoot since the apparent issue was with the API availability, disguising the fact that it was the dashboard that was overloading it.

Lianza said the core issue was a React useEffect hook with a "problematic object in its dependency array." The useEffect hook is a function with parameters including a setup function that returns a cleanup function, and an optional list of dependencies. The setup function runs every time a dependency changes.

In this Cloudflare case, the function made calls to the Tenant Service API, and one of the dependencies was an object that was "recreated on every state or prop change." The consequence was that the hook ran repeatedly during a single render of the dashboard, when it was only intended to run once. The function ran so often that the API was overloaded, causing the outage.

The useEffect hook is powerful but often overused. The documentation [react.dev] is full of warnings about misuse and common errors, and encouragement to use other approaches where possible. Performance pitfalls with useEffect are common.

The incident triggered a discussion in the community about the pros and cons of useEffect. One developer said on Reddit [reddit.com] there were too many complaints about useEffect, that it is an essential part of React, and "the idea that it is a bad thing to use is just silly." Another reaction [reddit.com], though, was "the message has not yet been received. Nearly everyone I know continues to put tons of useEffects everywhere for no reason."

Another remarked [reddit.com]: "the real problem is the API going down by excessive API calls... in a company that had dedicated services to prevent DDoS [Distributed Denial of Service]."

Lianza said the Tenant Service had not been allocated sufficient capacity to "handle spikes in load like this" and more resources have now been allocated to it, along with improved monitoring. In addition, new information has been added to API calls from the dashboard to distinguish retries from new requests, since if the team had known that it was seeing "a large volume of new requests, it would have made it easier to identify the issue as a loop in the dashboard." ®

Get ourTech Resources [theregister.com]ShareMore about

  • API
  • Cloudflare
  • DDoS

More like these×More about

  • API
  • Cloudflare
  • DDoS
  • Developer

Narrower topics

  • Git
  • Programming Language
  • Software bug

Broader topics

  • Devops
  • Security

More about ShareMore about

  • API
  • Cloudflare
  • DDoS

More like these×More about

  • API
  • Cloudflare
  • DDoS
  • Developer

Narrower topics

  • Git
  • Programming Language
  • Software bug

Broader topics

  • Devops
  • Security

TIP US OFF

Send us news [theregister.com]

Cloudflare accidentally DDoS-attacked itself [mashable.com]:

Cloudflare, a platform that provides network services, was the victim of a DDoS attack last week. It was also accidentally the cause of it.

You might remember Cloudflare was linked to a massive outage in June [mashable.com] of this year. When Cloudflare went down, so did sites like Spotify, Google, Snapchat, Discord, Character.ai, and more, all of which rely on Cloudflare's services. That time, the disruption was sparked by a Google Cloud outage. Earlier this month, Cloudflare had another blunder, albeit much less disruptive than its outage from the summer — but this time, it did it to itself.

"We had an outage in our Tenant Service API which led to a broad outage of many of our APIs and the Cloudflare Dashboard," Tom Lianza [cloudflare.com], the vice president of engineering for Cloudflare and Joaquin Madruga [cloudflare.com], the vice president of engineering for the developer platform at Cloudflare, wrote in a Sept. 13 blog post [cloudflare.com]. "The incident’s impact stemmed from several issues, but the immediate trigger was a bug in the dashboard."

Mashable Light SpeedLoading... Sign Me UpUse this instead By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use [ziffdavis.com] and Privacy Policy [ziffdavis.com]. You May Also Like

The bug, according to Lianza and Madruga, caused "repeated, unnecessary calls to the Tenant Service API." On accident, Cloudflare included a "problematic object in its dependency array" which was recreated, treated as new, caused it to re-run, and, eventually, the "API call executed many times during a single dashboard render instead of just once."

"When the Tenant Service became overloaded, it had an impact on other APIs and the dashboard because Tenant Service is part of our API request authorization logic. Without Tenant Service, API request authorization can not be evaluated. When authorization evaluation fails, API requests return 5xx status codes," the blog reads.

Everything is back on track at Cloudflare for now.

"We’re very sorry about the disruption," the blog post reads. "We will continue to investigate this issue and make improvements to our systems and processes."

Senior Culture Reporter

Christianna Silva is a senior culture reporter covering social platforms and the creator economy, with a focus on the intersection of social media, politics, and the economic systems that govern us. Since joining Mashable in 2021, they have reported extensively on meme creators [mashable.com], content moderation [mashable.com], and the nature of [mashable.com]online creation [mashable.com]under capitalism [mashable.com].

Before joining Mashable, they worked as an editor at NPR and MTV News, a reporter at Teen Vogue and VICE News, and as a stablehand at a mini-horse farm. You can follow her on Bluesky @christiannaj.bsky.social [christiannaj.bsky.social] and Instagram @christianna_j [instagram.com].

It could be huge for publishers. By Tim Marcin [mashable.com]The tube site blocked, restored, and now blocked itself again due to France's age-verification law. By Anna Iovine [mashable.com]Ships free, too. By Sponsored by StackCommerce [mashable.com]The problem has now been fixed, according to Amazon. By Chance Townsend [mashable.com]Forget about vacuuming for a few months at a time. You're welcome. By Leah Stodart [mashable.com]Everything you need to solve 'Connections' #835. By Mashable Team [mashable.com]Here are some tips and tricks to help you find the answer to "Wordle" #1556. By Mashable Team [mashable.com]The "deliver later" feature disappeared overnight, and Libby users are not OK. By Samantha Mangino [mashable.com]Every hint, nudge and outright answer you need to complete today's NYT Strands puzzle. By Mashable Team [mashable.com]Here are some tips and tricks to help you find the answer to "Wordle" #1555. By Mashable Team [mashable.com]Loading... Sign Me UpUse this instead These newsletters may contain advertising, deals, or affiliate links. By clicking Subscribe, you confirm you are 16+ and agree to our Terms of Use [ziffdavis.com] and Privacy Policy [ziffdavis.com].

  • " rel="url2html-5191">https://www.tiktok.com/@mashable">

©2005–2025 Mashable, Inc., a Ziff Davis company. All Rights Reserved.Mashable is a registered trademark of Ziff Davis and may not be used by third parties without express written permission.

;

Original Submission