Unauthenticated pages erroneously cached

What to do

• Check whether you use Railway US East (Virginia, USA), US West (California, USA), TCP Proxy (Metal), EU West (Amsterdam, Netherlands) and 1 more in apac, eu, us. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 5h 16m it lasted.

  Anything that failed between 2026-03-30 12:20 UTC and 2026-03-30 17:37 UTC may need a replay.

• Subscribe to Railway's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=railway works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Railway 4

1. investigatingMar 30, 2026, 12:20 PM UTC

   While updating our edge CDN to allow us to identify cached assets on a per-domain basis, we enabled a feature called “Surrogate Keys”. Unknowingly to us, this bypassed our “if CDN is disabled for this domain, pass directly to origin” behavior, which meant that we accidentally enabled CDN caching capabilities for domains that didn’t previously have it enabled. Because of that, the following assets may have been cached during this 30 minute period even with domains with the CDN feature disabled: Any content with public Cache-Control headers Images, videos and other known-static assets No HTML would’ve been cached; this is always considered dynamic At 11:30 UTC, once realizing the mistake, we immediately pushed an update which reverted this behavior and purged the cache of all assets globally.

   provider

2. monitoringMar 30, 2026, 12:21 PM UTC

   This is a retroactive incident that was resolved at 11:30 UTC. We are still determining impact.

   provider

3. monitoringMar 30, 2026, 12:27 PM UTC

   We are seeing reports that even content without cache-control set was erroneously cached. We are still determining impact.

   provider

4. resolvedMar 30, 2026, 5:37 PM UTC

   This incident has been resolved. A postmortem is available at https://blog.railway.com/p/incident-report-march-30-2026-accidental-cdn-caching.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.