Executive brief
Hotwired Turbo is a JavaScript library used to build fast, interactive web applications by enabling partial page updates without full reloads. A race condition in Turbo Frames can allow delayed HTTP responses to restore expired session cookies, potentially undoing logout operations or restoring previous user authentication state on applications using client-side cookie-based sessions.
Technical details
A race condition exists in Turbo Frames where in-flight HTTP requests can restore stale session cookies through Set-Cookie headers in delayed responses. When a session-modifying action (such as logout) occurs while a Turbo Frame request is pending, the delayed response may include a Set-Cookie header with the session state from before the modification, causing the browser to restore an invalidated session cookie. The vulnerability requires either naturally slow network conditions or an active network attacker capable of delaying responses. The impact is limited to applications using client-side cookie storage; server-side session stores (Redis, database) remain unaffected. The fix, available in Turbo 8.0.21+, cancels in-flight Turbo Frame requests when the frame is disconnected, disabled, or its source is cleared.
Affected products
- Hotwired Turbo <= 8.0.20
Timeline
- 2026-01-20: disclosed
- 2026-01-20: patched: Turbo 8.0.21 released