CVE-2025-66803
1 advisory.
npm/@hotwired/turbo CVE-2025-66803: low
Turbo Frame responses can restore stale session cookies
Action: Upgrade @hotwired/turbo to 8.0.21 or later.
npm i @hotwired/turbo@8.0.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.0.21 | - |
Fixed versions
| 8.0.21 |
Sources
- osv: GHSA-qppm-g56g-fpvp
- https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp
- https://nvd.nist.gov/vuln/detail/CVE-2025-66803
- https://github.com/hotwired/turbo/pull/1399
- https://github.com/hotwired/turbo/commit/899df356e9f4b3303cca217cd14b3f846edda10d
- https://github.com/hotwired/turbo
- https://github.com/hotwired/turbo/releases/tag/v8.0.21
- https://turbo.hotwired.dev/handbook/frames
CVE-2025-66803 · published · modified · JSON