Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@hotwired/turbo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.7npmAmendedPublished

    Turbo Frame responses can restore stale session cookies

    CVE-2025-66803 · GHSA-qppm-g56g-fpvp

    Affected
    • npm @hotwired/turbo <= 8.0.20
    Fixed in
    8.0.21· Vendor fix available
    Issue
    A race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations. Details Browsers automatically process Set-Cookie headers from HTTP responses. When a Turbo Frame request is in-flight during a session-modifying action (such as logout), the delayed response may include a Set-Cookie header reflecting the session state at request time. This can result in stale session cookies being restored after the session was intentionally modified or invalidated. This condition can occur naturally on slow networks. An active network attacker capable of delaying responses could potentially exploit this to restore previous session state. Impact Applications using Turbo Frames with cookie-based session storage may experience: - Session state reversion after logout - Unintended restoration of previous authentication state The impact is limited to applications using client-side cookie storage for sessions. Applications using…

    Recommended action: Upgrade to 8.0.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →