AIKIDO-2025-10755
@reduxjs/toolkit is vulnerable to Exposure of Resource to Wrong Sphere
75
High Risk
This Affects:
@reduxjs/toolkitTL;DR
Affected versions of this package may expose internal subscription state across multiple Redux store instances in SSR (Server-Side Rendering) environments due to a shared InternalMiddlewareState reference. This bug allows unintended data persistence or leakage of active subscription metadata between stores. The patch ensures that subscription data is correctly scoped per store using a WeakMap<Dispatch, Thing>, preventing cross-store data exposure and improving cleanup reliability.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you are using SSR.
Background info
@reduxjs/toolkit is vulnerable to Exposure of Resource to Wrong Sphere in versions 2.9.0 - 2.9.1.
How to fix this
Upgrade the @reduxjs/toolkit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant