Cloudflare’s Hyper bug left your apps wide open

Cloudflare’s Hyper, the HTTP/2 multiplexing engine that powers a chunk of the web, had a bug. It let a single client open a flood of requests through one connection. The engine didn’t properly track how many streams were active.

That meant you could send dozens of requests at once without the server knowing. It’s a classic stream-counting issue. The fix is simple in theory. In practice, it touches how your app handles incoming traffic.

Cloudflare patched it. The blog post doesn’t give you a CVE number or a timeline. It just says: fix it, check your logs, and watch your HTTP/2 traffic.

If you run a site on Cloudflare, you’re probably already running Hyper. It’s the default for HTTP/2. If you’re using it for API calls, real-time apps, or a busy frontend, you might have been sending too many requests through one connection.

The fix is a config change. Not a rewrite. But if you’re running a small business site, a side hustle, or a community app, the question is whether you even noticed. Most people don’t. They see 200 OK and move on.

Why this matters for us: when your site is on someone else’s pipes, a bug like this can slow you down or open you up to abuse — and you won’t know until it’s too late.