A popular cache key expires and hundreds of requests hit the database at once. How do you prevent that?

Prevent the stampede with single flight: the first request to miss takes a short lock and recomputes while the others wait briefly or serve the stale value. Combine that with stale while revalidate, so an expired entry is still served while a background refresh runs, and add jitter to time to live values so keys created together do not expire together. For known hot keys, refresh proactively before expiry.

The pattern is a thundering herd: one hot key expires and every concurrent request misses at the same moment, so they all run the same expensive query. The core fix is single flight, where the first miss acquires a short lived lock on the key and does the work, and everyone else either waits on the result or gets the stale value for a moment. I pair that with soft expiry: I store a logical refresh time inside the value and keep the hard time to live longer, so an entry past its refresh time is still served while one worker recomputes it in the background. Users never see the latency at all. Then jitter, because if a deploy warms a thousand keys with the same five minute time to live they expire together and I get the stampede across the whole cache at once. The bigger question that follows is what happens when the cache is empty entirely, after a restart or a failover. I want the database to survive that, so I load test with the cache disabled at least once.