Systems, methods, apparatus, and software for transitional caching in content delivery networks includes edge cache nodes configured to receive and reply to content requests. Content can be cached in edge cache nodes before receiving user requests or retrieved from an origin server. A transitional cache node array is configured to receive content requests from edge cache nodes and to receive origin content from edge cache nodes and/or origin servers, as well as to modify origin content to generate modified content. Modified content can include re-written origin content (e.g., translations), transcoded data (e.g., video), compressed or otherwise adjusted data (e.g., images), and transformed files (e.g., CSS and JavaScript files), among others. In addition to assisting with original and modified content flow to end users, transitional caching also can assist in threat detection and mitigation within a CDN, helping to protect the network, origin servers and the like.