Buttondown Outage Explained: Database Pool Saturation and Queue Starvation
On September 9, 2026, Buttondown's web app and email sending were disrupted for about two hours due to a saturated database connection pool, caused by a large broadcast and an admin page hitting the primary database. The backlog in background jobs led to worker fleet scaling up, which further strained the system. No data was lost, and all emails were eventually delivered.
The incident stemmed from a cascading failure in job prioritization. When a large broadcast exceeded its per-minute sending cap, batches were re-queued with their original deadlines, causing every worker to repeatedly select these same redriven jobs and ignore other pending work. This created a growing backlog that triggered the worker fleet to expand to its maximum of 40 instances, which in turn consumed the database connection pool that web requests depended on.
A separate internal admin page compounded the problem by running two inefficient aggregate queries on every load, with one query scanning roughly 3.2 million rows due to a JSON operator mismatch with its index. Between 19:00 and 19:30 UTC, that single page accounted for 78% of all primary database time. The fix involved pausing the offending broadcast and killing the problematic admin traffic.
This outage illustrates how fragile cloud-based newsletter infrastructure can be, even for established platforms. Independent writers and small businesses that rely on Buttondown for revenue-generating communications could face delayed time-sensitive messages, potentially affecting sales or subscriber trust. The incident may also prompt other software teams to audit their own connection pooling and job prioritization logic, as similar architectural patterns are common across the industry.