Why Cloudflare Replaced Nginx with Rust‑Powered Pingora for Faster, Safer Proxies

For years Cloudflare relied on Nginx as part of its HTTP proxy stack, but it has now replaced Nginx with an internally developed Rust‑based proxy called Pingora, which the company says is faster, more efficient, and more versatile for current and future products.

Pingora can handle over a trillion requests per day while delivering better performance using roughly one‑third of the CPU and memory that Nginx required.

As Cloudflare’s scale grew, the limits of Nginx became apparent: “We can no longer achieve the performance we need, and Nginx lacks the features required for our highly complex environment.”

Pingora now powers Cloudflare’s CDN, Workers fetch, Tunnel, Stream, R2, and many other services.

The switch was driven by architectural constraints in Nginx that hurt performance and made adding new functionality difficult, as well as a relatively inactive Nginx community and “closed‑door” development practices.

Rust was chosen because it provides memory safety without sacrificing the speed of C; Cloudflare also built its own Rust HTTP library to meet diverse needs, and Pingora uses a multithreaded rather than multiprocess architecture.

Performance measurements show Pingora reduces median TTFB by 5 ms and the 95th percentile by 80 ms; it creates only one‑third as many new connections per second as the old service, while connection reuse rose from 87.1 % to 99.92 %, cutting origin connections by a factor of 160 and saving an estimated 434 years of handshake time each day.

In production, under the same traffic load, Pingora cuts CPU and memory consumption by about 70 % and 67 % respectively, and is considered more secure thanks to Rust, though it is not yet open‑source.

More details are available on Cloudflare’s official blog.