Shared /tmp State
Serverless functions reuse execution environments between invocations, so sensitive files written to /tmp can be read by later requests from different users.
How It Works
AWS Lambda and similar platforms keep warm execution environments alive to avoid cold starts. If your function writes a user's data to /tmp and doesn't clean it up, the next invocation in the same environment can read it — even if it's a completely different user's request.
// BAD: user data written to /tmp without cleanup
export const handler = async (event) => {
const userId = event.userId;
fs.writeFileSync('/tmp/user-data.json', JSON.stringify(event.sensitiveData));
// no cleanup — next invocation reads this file
};// GOOD: always clean up /tmp and use user-specific filenames
export const handler = async (event) => {
const tmpFile = `/tmp/${event.requestId}-data.json`;
try {
fs.writeFileSync(tmpFile, JSON.stringify(event.data));
// process the file...
} finally {
if (fs.existsSync(tmpFile)) fs.unlinkSync(tmpFile); // always clean up
}
};Real-World Example
Researchers at PureSec (now Palo Alto Prisma Cloud) documented /tmp leakage as a recurring Lambda security issue in their 2019 serverless security report, showing that cached execution environments regularly expose cross-request data.
How to Prevent It
- Always delete /tmp files in a finally block after use
- Use unique, request-scoped filenames (include requestId) so concurrent executions don't collide
- Prefer in-memory processing over /tmp files when the data fits in RAM
- Treat /tmp as a shared, untrusted filesystem — never write unencrypted sensitive data there
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Function Timeout Abuse
mediumServerless functions without a configured timeout can be kept running indefinitely by malicious or malformed requests, draining your budget.
Over-privileged IAM Roles
mediumGiving serverless functions or services more IAM permissions than they need turns a minor breach into a full account compromise.
Environment Variables in Logs
highLogging process.env dumps all your secrets — API keys, database passwords, signing keys — directly into your log system.
Cold Start State Leak
mediumGlobal variables in serverless functions persist across invocations in the same execution environment, leaking user data between requests.