The sequence
A cache stampede follows a precise sequence, and it is worth walking slowly.
A popular key is serving 5,000 requests a second from memory. Its expiry passes. For the next few hundred milliseconds every one of those requests misses, and each one goes to your database to recompute the same value.
Watch the feedback loop, because that is the dangerous part. Your database takes thousands of identical queries at once and slows down, which widens the window before the first answer refills the cache, which lets more requests pile in.
Read it plainly: the stampede makes recomputation slower, and slower recomputation makes the stampede bigger.
Do the arithmetic for one key. A query taking 100 milliseconds under normal load, on a key read 5,000 times a second, means 500 copies of the same query running the instant it expires.
Push that query to 2 seconds under contention and you have 10,000 in flight. Your connection pools drain, unrelated queries queue behind the pileup, and one expired key has taken down your whole database rather than its own endpoint.
Three triggers
Distinguish the three triggers, because the defences differ. One hot key expiring is the classic.
Mass expiry is subtler. A deploy populated thousands of keys in the same second, so they carry the same lifetime and all die in the same second, days later, long after anybody remembers that deploy.
Cold start is the total version, a restarted or flushed cache where every key misses at once, and that is why warming a large cache before it takes traffic is standard practice.
Hold the insight that unifies every defence: your database only needs to compute each expired value once. Everything in the next lesson is a way of enforcing that.
Worked example
Chen is on call at a sports media company during a championship final. The live scoreboard JSON is cached with a 10-second TTL and read 40,000 times a second at peak. Each expiry normally causes a handful of overlapping recomputes, absorbed without drama. In overtime, a slow analytics query happens to be hogging the database when the scoreboard key expires, so the recompute that usually takes 80 ms takes 4 seconds. In those 4 seconds, roughly 160,000 requests miss and pile onto the database, which saturates its 500-connection pool in the first second. Every other feature sharing that database, login included, goes down with it. Total outage: 9 minutes, at the peak minute of the year. The postmortem's first line: one key expired.