Is CVE-2025-66803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66803 being exploited in the wild.

How severe is CVE-2025-66803?

Medium severity, with a CVSS score of 4, published 20 January 2026.

Which products and versions are affected?

@hotwired/turbo (npm) SEMVER:introduced=0,fixed=8.0.21.

Is there a fix for CVE-2025-66803?

Yes. @hotwired/turbo (npm): upgrade to 8.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66803 attacked?

It is attacked over the network.

Am I affected by CVE-2025-66803?

Check whether you run @hotwired/turbo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66803: Hotwired Turbo race condition in session cookie handling

CVE-2025-66803 · Severity: medium · CVSS 4 · Published 2026-01-20

Hotwired Turbo is a JavaScript library used to build fast, interactive web applications by enabling partial page updates without full reloads. A race condition in Turbo Frames can allow delayed HTTP responses to restore expired session cookies, potentially undoing logout operations or restoring previous user authentication state on applications using client-side cookie-based sessions.

Vendors: npm.

Quick answers

Is CVE-2025-66803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66803 being exploited in the wild.
How severe is CVE-2025-66803?: Medium severity, with a CVSS score of 4, published 20 January 2026.
Which products and versions are affected?: @hotwired/turbo (npm) SEMVER:introduced=0,fixed=8.0.21.
Is there a fix for CVE-2025-66803?: Yes. @hotwired/turbo (npm): upgrade to 8.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66803 attacked?: It is attacked over the network.
Am I affected by CVE-2025-66803?: Check whether you run @hotwired/turbo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hotwired/turbo (npm): upgrade to 8.0.21 or later
```
npm install @hotwired/turbo@8.0.21
```

Technical details

A race condition exists in Turbo Frames where in-flight HTTP requests can restore stale session cookies through Set-Cookie headers in delayed responses. When a session-modifying action (such as logout) occurs while a Turbo Frame request is pending, the delayed response may include a Set-Cookie header with the session state from before the modification, causing the browser to restore an invalidated session cookie. The vulnerability requires either naturally slow network conditions or an active network attacker capable of delaying responses. The impact is limited to applications using client-side cookie storage; server-side session stores (Redis, database) remain unaffected. The fix, available in Turbo 8.0.21+, cancels in-flight Turbo Frame requests when the frame is disconnected, disabled, or its source is cleared.

Affected products

Hotwired Turbo <= 8.0.20

Identifiers

CVE-2025-66803
GHSA-qppm-g56g-fpvp

Timeline

2026-01-20: disclosed
2026-01-20: patched: Turbo 8.0.21 released

References

https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.