CVE-2025-66803: @hotwired/turbo - Race Condition Allows Restoration of Stale Session Cookies
Summary
CVE-2025-66803: Turbo Frame responses can restore stale session cookies. Affects @hotwired/turbo versions < 8.0.21. Fixed in 8.0.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hotwired/turbo package is a JavaScript framework designed to enhance web applications by enabling faster navigation and improved user experiences through Turbo Frames and Turbo Streams. It allows developers to build dynamic applications with minimal effort by managing page updates without full reloads. However, a race condition vulnerability exists that can compromise session integrity, particularly in applications relying on cookie-based session storage.
Vulnerability Detail
A race condition in Turbo Frames can lead to delayed HTTP responses that restore stale session cookies after session-modifying operations, such as logout. When a Turbo Frame request is in-flight during such actions, the delayed response may include a Set-Cookie header reflecting the session state at the time of the request. This can result in unintended restoration of previous authentication states, allowing attackers to exploit slow networks or manipulate response timings to revert session states.
How To Fix
Minimum fixed version
8.0.21
This is the first release that contains the fix.
npm install @hotwired/turbo@8.0.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider the following workarounds: 1. Use server-side session storage instead of cookie-based storage. 2. Ensure that logout flows remove or disable Turbo Frame elements before invalidating sessions. This can be done by adding the following code snippet to your logout function:
const turboFrame = document.getElementById('your-turbo-frame-id');
if (turboFrame) {
turboFrame.remove(); // or turboFrame.disabled = true;
}
Conclusion
The CVE-2025-66803 vulnerability in the @hotwired/turbo package poses a risk to applications using cookie-based session storage. It is crucial to upgrade to version 8.0.21 or later to mitigate this risk. Implementing workarounds can provide temporary relief while planning for an upgrade.
See every vulnerability recorded for @hotwired/turbo →
FAQ
The vulnerability is a race condition that allows stale session cookies to be restored after session-modifying actions, potentially leading to unauthorized access.
Applications using the @hotwired/turbo package with cookie-based session storage are primarily affected.
The CVSS score of this vulnerability is 1.7, indicating a low severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Implement the suggested workarounds, such as using server-side session storage or modifying logout flows to disable Turbo Frame elements before session invalidation.
