Multi-Tier Cache (Mitigate CVE-2025-36852)

[dougalg-js-tw]

Goals

1. Enable support for multi-tier cache
2. Mitigate CVE-2025-36852

Non-goals

No response

Background

By default it seems that turbo cache is shared across prod and non-prod builds which appears to fall under the CVE-2025-36852 cache poisoning vulnerability.

Currently the only way around this that I can see is to manually separate prod and non-prod caches with separate access tokens.

Proposal

It would be nice to get more performance by enabling a multi-tier cache so that users can fetch from the prod cache as an automatic fallback but only write to it from prod envs.