On January 22, 2026, Cloudflare publicly disclosed a routing incident caused by an automated configuration error within its network. The issue resulted in a Border Gateway Protocol (BGP) route leak originating from one of Cloudflare’s routers located in Miami, Florida. While the incident was short-lived, it had visible effects on internet routing and performance for a subset of networks.
The problem was not the result of a cyberattack or software vulnerability. Instead, it stemmed from a misconfiguration introduced during routine routing policy changes.
What Went Wrong
Under normal circumstances, Cloudflare’s internal routing announcements are carefully controlled to ensure that only the correct routes are advertised to external BGP peers. In this incident, however, routes that were meant to remain internal were mistakenly announced to multiple external neighbors.
As a result, traffic destined for certain IP prefixes was redirected through the Miami data center, even when that path was not optimal. This sudden influx of traffic overwhelmed parts of the network, leading to congestion, packet loss, and increased latency for some Cloudflare customers as well as other networks that rely on global routing stability.
Root Cause: A Policy Misconfiguration
The underlying cause of the route leak was a routing policy update intended to restrict specific IPv6 prefixes—such as those associated with Bogotá—from being announced by the Miami router. During the update process, engineers modified prefix lists and export policies to fine-tune which routes should be advertised.
However, a critical condition within the policy was inadvertently removed. That condition had previously limited route exports to a narrow, intended set of prefixes. Without it, the policy became overly permissive and matched far more routes than intended. As a result, a large number of internal IPv6 routes were exported externally.
Importantly, this was not due to a flaw in Cloudflare’s routing software. It was a human and automation error that occurred during policy modification—an example of how small configuration changes in BGP can have outsized consequences.
Understanding BGP Route Leaks
A BGP route leak occurs when a network advertises routes beyond their intended scope or to the wrong peers. Because BGP is built on trust between networks, these incorrect announcements can quickly propagate across the internet.
Route leaks differ from BGP hijacks. Hijacks are typically malicious, involving intentional false advertisements. Route leaks, by contrast, are almost always accidental and caused by configuration mistakes, policy errors, or automation failures.
Impact and Visibility
The Cloudflare route leak lasted for approximately 25 minutes, but during that time it was visible on global BGP monitoring platforms. Due to the distributed nature of internet routing, the incorrect announcements spread before being withdrawn.
Although the incident was brief, some networks experienced degraded performance, including higher latency and sub-optimal routing paths. Even non-malicious routing errors like this can disrupt connectivity when they occur at scale.
Response and Preventive Measures
Cloudflare quickly identified the issue, rolled back the faulty configuration, and published a detailed post-mortem explaining what happened. The company emphasized improvements to automation safeguards, policy validation, and configuration review processes to reduce the likelihood of similar incidents in the future.
Cloudflare also noted that BGP route leaks are an industry-wide challenge, highlighting the ongoing need for stronger routing safeguards across the global internet—not just within a single organization.
