React Hook Causes Downtime at Cloudflare, Which Just Stopped the Biggest Ddos

Posted4 months agoActive4 months ago

KalanaPerera

13 points

6 comments

blog.cloudflare.comTechstory

calmmixed

Debate

40/100

ReactCloudflareDdosJavascript

Key topics

React

Cloudflare

Ddos

Javascript

A React hook caused downtime at Cloudflare, which had just mitigated a massive DDoS attack, sparking a discussion about the pitfalls of using React and JavaScript.

Snapshot generated from the HN discussion

Discussion Activity

Light discussion

First comment

22m

Peak period

0-1h

Avg / period

Key moments

01Story posted
Sep 18, 2025 at 10:02 AM EDT
4 months ago
Step 01
02First comment
Sep 18, 2025 at 10:24 AM EDT
22m after posting
Step 02
03Peak activity
4 comments in 0-1h
Hottest window of the conversation
Step 03
04Latest activity
Sep 18, 2025 at 2:22 PM EDT
4 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (6 comments)

Showing 6 comments

cluckindan

4 months ago

1 reply

Time for ”React considered harmful”

bot403

4 months ago

Tomorrow's headline: react use effect hook leads to new, largest npm supply chain attack.

DanielHB

4 months ago

2 replies

It is unfortunate JS doesn't have better capabilities for dealing with immutable data. This is the one major flaw in the React ecosystem. It is quite easy to make this mistake (even with lint rules) and to avoid it in a statically-enforceable way you need a lot of userland cruft that is just not viable to do.

It gets even worse when you start to pass values down several layers of components when the average advice on the web is "don't overuse useMemo". For those unfamiliar it is a way to memoize a value so you get a stable reference that is only mutated if the underlying data mutates, it basically avoids this specific issue.

React wants you to code in functional immutable style, but the language doesn't provide proper immutable data structures.

sangupta

4 months ago

I agree that runtime support will definitely help. However, a simple mitigation strategy is to override the `fetch` function and provide a central rate-limiting. This helps prevent such incidents even if this kind of bugs are shipped to production.

have_faith

4 months ago

These types of issues have to be the largest footguns in the react architecture. Relying so heavily on the linter to avoid the initial dependency mismatch issues and then on memoising to avoid the re-triggering can really feel like dancing on eggshells.

lysace

4 months ago

"Ooh, self-DDoS! Those are rare!"

View full discussion on Hacker News

ID: 45289848Type: storyLast synced: 11/20/2025, 6:30:43 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.

Open link View on HN