119 points by bavarianbob 2 days ago
EDIT: Back online?!
NPM discussion: https://github.com/npm/cli/issues/8203
NPM incident: https://status.npmjs.org/incidents/hdtkrsqp134s
Cloudflare messaging: https://www.cloudflarestatus.com/incidents/gshczn1wxh74
GitHub issue: https://github.com/sindresorhus/camelcase/issues/114
Anyone experiencing npm outage that's more than just the referenced camelcase package?
> any site using that will have URLs containing 'camel' blocked
What engineer at cloudflare thought this was a good resolution?
Akamai has been doing precisely that for years & years...
Judging by previous outages it was probably a poorly tested overcomplicated regex which matched to much.
Confirmed here: https://www.cloudflarestatus.com/incidents/gshczn1wxh74
To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot shit like automated port scanners, Metasploit or similar skiddie tooling across all the services that use them.
Honestly what I'd _love_ to see is AWS, GCE, Azure, Fastly, Cloudflare and Akamai band together and share information about such bad actors, compile evidence lists and file abuse reports against their ISP - or in case the ISP is a "bulletproof hoster" or certain enemy states, initiate enforcement actors like governments to get these bad ISPs disconnected from the Internet.
Any path with the word "camel" seem to trigger this: https://www.npmjs.com/search?q=camel | https://registry.npmjs.org/camel123 | https://registry.yarnpkg.com/camel456
Some discussion here https://github.com/npm/cli/issues/8203
Edit: this is resolved now https://status.npmjs.org/incidents/hdtkrsqp134s
This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538
Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.
> a product that mostly doesn't do anything except for occasionally break the internet
I wouldn't say that. The postmortem you referred to links to another CloudFlare blog post - one about a pretty serious RCE vuln in Microsoft SharePoint that was blocked by their WAF: https://blog.cloudflare.com/stopping-cve-2019-0604/
Sadly I work with web developers that all assume they don’t need to bother too much with security “because we have a WAF”.
I'm not sure why "WAF has false positives" makes it useless, nor would I say this is anywhere near the scale of "breaking the internet" and I'm not even fan of the concept of WAFs in general.
Basically CF default WAF settings saved more small and medium companies I can even count to. I’m not CF fan, but WAFs (with rate limiting) do help. Sad that one or two incidents for that complicated and big services make people post such comments, but cmon - it doesn’t have AI in it's name so sheeps have to cry, right?
we've used it to rescue some vintage appliances that are basically unsecurable.
The npm folks have officially acknowledged an incident now: https://status.npmjs.org/incidents/hdtkrsqp134s
Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule.
That rule can be overridden if you're having this issue on your own site.