2026 Railway — accidental CDN caching on opt-out domains (~52 min; cross-user response leakage)

Railway, a developer PaaS, published an incident report for March 30, 2026 describing a configuration change (10:42–11:34 UTC, ~52 minutes) that accidentally enabled CDN caching on a small fraction (~0.05%) of customer domains where CDN had been disabled. During the window, HTTP GET responses—including some authenticated page bodies without Set-Cookie headers—could be cached at the edge and served to users other than the original requester, effectively allowing one user’s application responses to be shown to another in affected cases. Railway reverted the change, purged caches globally, and outlined follow-on testing and phased rollout safeguards. Impact varied by application cache headers; customers were notified when applicable per the company’s post-incident communications.