CVE-2025-66803: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66803 is a race condition vulnerability in Hotwired Turbo (the npm turbo package) that allows Turbo Frame responses to restore stale session cookies after session-modifying operations such as logout. Affecting all versions up to and including 8.0.20, it was disclosed on January 17, 2026, and patched in version 8.0.21. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is a TOCTOU (Time-of-Check Time-of-Use) race condition (CWE-367) combined with insufficient session expiration handling (CWE-613). When a Turbo Frame initiates an HTTP request and that request is still in-flight during a session-modifying action (e.g., logout), the browser automatically processes any Set-Cookie headers in the delayed response — restoring the session cookie to its pre-logout state. This occurs because browsers process Set-Cookie headers without giving client-side JavaScript a chance to intercept or validate staleness. The fix, implemented in PR #1399, cancels in-flight Turbo Frame fetch requests when the frame element is disconnected from the DOM, its disabled attribute is set, or its src attribute is cleared (GitHub Advisory, Turbo PR #1399, Patch Commit).

Successful exploitation can cause session state reversion after logout, potentially restoring a user's previous authenticated session without their knowledge. This results in low confidentiality and integrity impacts — an attacker or subsequent user of the same browser could gain unintended access to a previously authenticated session. The vulnerability is strictly limited to applications using client-side cookie-based session storage (e.g., Rails cookie store); applications using server-side session stores such as Redis or a database are not meaningfully affected, as the server-side session state remains authoritative (GitHub Advisory).

No active in-the-wild exploitation has been confirmed. A proof-of-concept reproduction repository was referenced in the PR discussion, but no weaponized exploit code is publicly available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.048%, reflecting very low probability of exploitation in the near term. Exploitation requires either a slow network (where the race condition occurs naturally) or an active network attacker capable of delaying HTTP responses (GitHub Advisory, Feedly).

1. Identify a target application: Locate a web application using Hotwired Turbo ≤ 8.0.20 with cookie-based session storage (e.g., Rails cookie store) and Turbo Frame elements that load content from slow or controllable endpoints.
2. Initiate a Turbo Frame request: As an authenticated user, trigger a Turbo Frame to begin loading a slow endpoint (e.g., a page section with a <turbo-frame src="/slow-endpoint"> element), causing an in-flight HTTP request.
3. Trigger a session-modifying action: While the Turbo Frame request is still in-flight, perform a session-modifying action such as logging out. The server invalidates the session and sends a new Set-Cookie header clearing the session.
4. Exploit the race condition: As a network attacker, delay the Turbo Frame response so it arrives after the logout response. The browser processes the delayed response's Set-Cookie header, restoring the stale session cookie from before logout.
5. Achieve session restoration: The user (or attacker with access to the browser) is now re-authenticated with the stale session cookie, effectively bypassing the logout (GitHub Advisory, Turbo PR #1399).

• Network: Delayed or out-of-order HTTP responses from Turbo Frame endpoints arriving after a logout response; Set-Cookie headers observed in Turbo Frame responses after session invalidation.
• Logs: Server-side access logs showing a Turbo Frame request (identifiable by the Turbo-Frame request header) completing after a logout request for the same session; session activity logged after a user's logout event.
• Application Behavior: Users reporting being logged back in immediately after logging out; session tokens appearing active in server-side logs after explicit invalidation.

Upgrade Hotwired Turbo to version 8.0.21 or later, which cancels in-flight Turbo Frame requests when the frame is disconnected, disabled, or its src is cleared, preventing stale responses from setting cookies (Turbo v8.0.21 Release). As a workaround, migrate from client-side cookie session storage to a server-side session store (e.g., Redis or database), which remains authoritative regardless of stale cookie restoration. Additionally, ensure logout flows explicitly remove or disable Turbo Frame elements before invalidating sessions to reduce the race window (GitHub Advisory).

The vulnerability was reported by community contributor samoli and remediated by domchristie and packagethief. The PR discussion noted that the race condition is an inherent browser behavior — browsers process Set-Cookie headers automatically without client-side intervention — and acknowledged that Turbo can only partially mitigate it (specifically the case where the frame is removed from the DOM). The fix was well-received by the Turbo community, with multiple contributors reacting positively to the patch (Turbo PR #1399).