4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66803

CVE-2025-66803: Turbo Frame responses can restore stale session cookies

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. delaying requests based on sequence or timing) or by physically proximate attackers when the race condition occurs naturally on shared computers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66803

CVE-2025-66803:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hotwired/turbo	npm	<= 8.0.20	8.0.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in Turbo Frames. The root cause is that in-flight network requests for Turbo Frames were not being canceled when the state of the frame element changed in a way that should have invalidated the request. Specifically, when a frame was disconnected from the DOM, disabled, or had its src attribute removed, any pending responses could still be processed by the browser. If these responses contained a Set-Cookie header from a previous session state (e.g., before a logout), they could restore a stale session cookie on the client-side, effectively reverting the session-invalidating action. The patch addresses this by explicitly canceling the currentFetchRequest within the disconnected, disabledChanged, and sourceURLChanged methods of the FrameController class. These functions are the key runtime indicators, as they are the points where the application logic failed to prevent the processing of a response from an invalidated request.

Vulnerable functions

FrameController.disconnected

src/core/frames/frame_controller.js

The `disconnected` function in `FrameController` did not cancel in-flight fetch requests when a frame was disconnected from the DOM. This allowed a delayed response to be processed, potentially restoring a stale session cookie after a user had logged out or their session was otherwise invalidated.

FrameController.disabledChanged

src/core/frames/frame_controller.js

The `disabledChanged` function in `FrameController` failed to cancel in-flight requests when the frame was disabled. This created a race condition where a response arriving after the frame was disabled could process a `Set-Cookie` header and restore an old session.

FrameController.sourceURLChanged

src/core/frames/frame_controller.js

The `sourceURLChanged` function in `FrameController` did not cancel the current fetch request when the frame's `src` attribute was removed. This allowed a pending network response to be processed even though the frame's source was cleared, leading to the potential restoration of an invalid session cookie.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.