502 Bad Gateway
A reverse proxy, load balancer, or CDN received an invalid response from the upstream origin server. The problem is between your edge and your backend, not between the client and the edge.
What It Means
The proxy successfully connected to the upstream server but received something it could not use: garbage data, a connection reset, or no response at all. Because the proxy cannot construct a valid response, it returns 502 to the client.
Common Causes
- Origin server crashed or is not running. The process exited, the container restarted, or the server is not listening on the expected port.
- Origin returned malformed HTTP. The upstream sent an invalid response that the proxy could not parse.
- Upstream timeout. The origin took too long to respond and the proxy closed the connection.
- DNS resolution failure for the origin. The proxy could not resolve the upstream hostname to an IP address.
- TLS handshake failure between proxy and origin. The proxy connects to the origin over HTTPS but the handshake fails due to certificate issues or protocol mismatches.
- Origin running out of resources. File descriptors, connection pool, or memory exhaustion causing the origin to drop connections.
502 vs 503 vs 504
- 502 Bad Gateway. The proxy got a bad or invalid response from the upstream.
- 503 Service Unavailable. The service is intentionally unavailable, usually due to overload or maintenance.
- 504 Gateway Timeout. The proxy got no response at all within the timeout window.
All three indicate the origin is the problem, not the edge or the client.
How to Diagnose
Use the Probe tool to confirm the 502 is visible from outside your network. Check the Status dashboard to see if the upstream cloud provider is reporting degradation. Use Traceroute to verify the network path between the edge and your origin. Then check your origin server logs, process status, and resource utilization.