Severity: 🟡 Medium (correctness / resource exhaustion)
Location
src/reactive/async-data.ts:469 (currentAbortController), :512-513 (reassigned per execute), :650-654 (abort targets only the latest).
Description
useAsyncData.execute() can run concurrently (a watch refresh overlapping a manual execute()/refresh()). Each useFetch handler creates a fresh AbortController and overwrites the shared currentAbortController. The earlier in-flight fetch is never aborted — it keeps consuming network/CPU; its result is merely discarded by the executionId guard. state.abort() can only cancel the most recent controller. Under rapid watch churn this produces a pile-up of un-cancellable in-flight requests.
Suggested fix
Before starting a new attempt, abort the previous controller (prev?.abort()), or track controllers per executionId and abort superseded ones. Optionally serialize executions.
Filed as part of a full-codebase security & correctness audit.
Severity: 🟡 Medium (correctness / resource exhaustion)
Location
src/reactive/async-data.ts:469(currentAbortController),:512-513(reassigned per execute),:650-654(aborttargets only the latest).Description
useAsyncData.execute()can run concurrently (awatchrefresh overlapping a manualexecute()/refresh()). EachuseFetchhandler creates a freshAbortControllerand overwrites the sharedcurrentAbortController. The earlier in-flight fetch is never aborted — it keeps consuming network/CPU; its result is merely discarded by theexecutionIdguard.state.abort()can only cancel the most recent controller. Under rapidwatchchurn this produces a pile-up of un-cancellable in-flight requests.Suggested fix
Before starting a new attempt, abort the previous controller (
prev?.abort()), or track controllers perexecutionIdand abort superseded ones. Optionally serialize executions.Filed as part of a full-codebase security & correctness audit.