---
title: "Mutable module state in server code (next/module-state)"
description: "A module-level variable lives as long as the server instance and is shared by every concurrent request: one user's data can leak into another's response."
url: http://localhost:4173/rules/next/module-state
updated: 2026-11-11
---

# Mutable module state in server code

> `next/module-state` is a vetd rule. It flags: Mutable module state in server code. It runs on every `check`, together with the TypeScript check.

| Fact | Value |
| --- | --- |
| Rule id | `next/module-state` |
| Severity | warning |
| Group | Server code: security and speed |
| Tags | security, correctness, nextjs-16 |

## Why it matters

A module-level variable lives as long as the server instance and is shared by every concurrent request: one user's data can leak into another's response.

## How to fix it

Keep per-request data in arguments, cookies or React cache(); use a real store for shared state.

## Credit

Based on work by:

- [Vercel](https://vercel.com): The react-best-practices skill warns against shared mutable module state on the server because concurrent requests see the same variables.

## References

- [react-best-practices: Avoid shared module state](https://github.com/vercel-labs/agent-skills/blob/main/skills/react-best-practices/rules/server-no-shared-module-state.md), Vercel (vercel-labs/agent-skills)
- [cache – React](https://react.dev/reference/react/cache), React
- [How to think about data security in Next.js](https://nextjs.org/docs/app/guides/data-security), Next.js

## See it

Demos in the vetd Lab:

- [Keep request data local](http://localhost:4173/lab/react-perf/keep-request-data-local)

## Related rules

- [`next/floating-promise`](http://localhost:4173/rules/next/floating-promise.md)

## Get this text from vetd

MCP: call `explain` with `{ "diagnosticId": "next/module-state" }`. CLI: `npx vetd explain next/module-state`.

---

[All 92 rules](http://localhost:4173/rules.md) · Previous: [`next/server-action-auth`](http://localhost:4173/rules/next/server-action-auth.md) · Next: [`next/sequential-await`](http://localhost:4173/rules/next/sequential-await.md)