How I Found an SSR Cache Isolation Failure in a React Data Fetching Library
There's a certain kind of bug that only shows up when you stop thinking about what code does and start thinking about when it does it. Most security researchers spend their time asking "can an attacker make this code do something bad?" That's a fine question. But it misses an entire category of vulnerabilities that have nothing to do with malicious input. Sometimes the code does something bad all…
The incident described in the source involves a security vulnerability in a popular React data fetching library used in many Next.js projects. This library manages caching differently for client-side and server-side rendering. On the server, it uses a module-level variable—a single Map object—to store cached data. This approach is problematic because modules are shared across all incoming requests in a Node.js environment, including concurrent requests.
The vulnerability allows data from one user's request to be served to another user's request, even though the two users should be completely isolated in terms of data visibility. The library offers a way to isolate caches per request using a provider component, but this feature is not enabled by default. The default configuration shares cache state across all users, making it easier for data leakage to occur.
The author of the story discovered this issue while auditing the library and provided a proof of concept demonstrating the vulnerability. The fix involves enabling the cache isolation provider, which creates a fresh cache for each request, ensuring that users' data remains private and secure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
