Content delivery network provider Cloudflare Inc. has patched a software bug that exposed sensitive information including passwords, cookies and tokens used to authenticate users from the websites of its 5.5 million users, including those of Uber Technologies Inc., OK Cupid and Fitbit Inc.

The discovery of the security flaw was first made by Google Project Zero security researcher Tavis Ormandy last week, and involved a flaw that is believed to have dated back to September that involved corrupted web pages being returned by some HTTP requests run through Cloudflare.

“I’m finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings,” Ormandy wrote. “We’re talking full HTTPS requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.”

Cloudflare operates as a CDN, a system of distributed servers that delivers web pages and other web content to a user based on geographic location. It’s used by companies to distribute their services across the globe. For example, if you’re in Southeast Asia and contacting Uber your web or app request would go through Cloudflare’s servers in Singapore versus contacting Uber’s servers in the United States directly.

What Travis found is that secure requests through Cloudflare’s network were corrupted, making user details, including passwords, publicly available. Even more disturbingly, the details were made so available that the data was cached by Google and other search engines.

Cloudflare is downplaying the incident, saying that despite the fact that data was cached by Google and others, the data was only available in “some unusual circumstances.”

The company blamed the security issue on three minor Cloudflare features that were using the same HTML parser chain that was causing the leakage: email obfuscation, server-side excludes, and automatic HTTPS rewrites.

Although the good news is that Cloudflare has now patched their service, the extent of leaked data is of deep concern to some. Privacy New Online called it the “worst privacy leak in recent Internet history.”

Image: wongo888/Flickr