Source-linked reports: Amounts and outcomes come from the original reports and linked replies.
Meathill: a Next.js prefetch loop, then R2 operation charges two months running.
Meathill (@meathill1) says a Next.js 16.3.x bug caused infinite prefetching that exhausted his Worker quota in September, used up the month’s Class A operations, and later made ISR caching cost more than Workers. In October he says a blog’s 404 pages going through ISR drove R2 Class A operations up again. He gives no amount.
What happened
- Reported cause
- Unbounded loop
- Incident date
- Date not recorded
- First reported
- 2026-09-04 13:43 UTC
- Billing outcome
- Not recorded
- Case progress
- Not established
- Public Cloudflare reply
- Not linked
Latest reported outcome
The author says he disabled ISR to test whether costs drop; no billing request or outcome is reported.
View this update in the timelineOriginal sources
Each entry links to the report or reply it describes.
Case timeline
Prefetch loop exhausts quota
Read on 𝕏The author says Next.js after 16.3.x has an infinite prefetch bug and the previous day’s traffic used up his entire Worker quota.
Meathill
@meathill1 · Original 𝕏 post
艹，next.js 真的有 bug，16.3.x 之后，会死循环 prefetch，昨天的流量直接就把我的 Worker 额度全线打爆了…… https://t.co/NS8PjNxk9T
Blog post on the incident
Read on 𝕏The author says a viral article exposed his site’s weak foundations: improper cache settings plus the Next.js infinite prefetch bug exhausted all Worker quotas.
Meathill
@meathill1 · Original 𝕏 post
https://t.co/jDUdD5pUz6 好久没写博客，最近踩一大坑，写出来给大家当前车之鉴。前几天关于AMD免费AI API的文章侥幸成为爆款，把https://t.co/CZZ6zVzqV0网站不够扎实的基础暴露的一塌糊涂。因为缓存设置不当加上中招next.js无限循环prefetch的bug，所有Worker额度均被打爆。希望对大家有帮助。
Class A operations used up
Read on 𝕏The author says the bug also used up the month’s Class A operations allowance, so ISR page caching now costs more than Workers, and he will disable ISR to test.
Meathill
@meathill1 · Original 𝕏 post
完蛋，上次的 bug 把这个月的 A 类操作额度也用完了，结果现在 ISR 页面缓存的价格反而比 worker 更贵……今天只好停掉 ISR 试试看，如果明天成本能降下来，以后低访问量的网页就不走 ISR 缓存了。
R2 operations up again in October
Read on 𝕏The author says September’s Next.js prefetch storm blew up R2 Class B operations and this month a blog’s 404 pages going through ISR blew up Class A operations.
Meathill
@meathill1 · Original 𝕏 post
其实哥们儿被 Cloudflare 背刺的经验也很丰富……月月都背刺，次次不一样。 上个月应该是 next.js prefetch 导致的大量页面被刷，导致 R2 B 操作爆炸。 这个月是博客网站 404 一样 ISR，导致 R2 A操作爆炸。 哎…… https://t.co/LL5Ss5PmzV
More to read
Budget alerts
Cloudflare documents account-wide spend alerts and their notification limits.
mcwangcn reports $1,300 in D1 charges after a bot attack.
@mcwangcn says D1 writes previously cost over a thousand dollars and separately mentions Workers CPU charges without giving an amount. He later shares a Cloudflare bill and says $1,300 of its $3,600 came from D1 after a bot attack.
Why hard spending caps take time: Ashley Peacock on billing latency
Ashley Peacock (@ashleypeacock), who works on Durable Objects at Cloudflare, explains from experience why near-real-time spending caps are hard to build, says hard billing caps are coming soon, and suggests budget alerts plus issue alerts in the meantime.