Module variable holds the current user

An SSR app on a long-running Node server stores the current user like this. Under load, some users see another person’s name in the header. What is happening?

// lib/current-user.ts
let currentUser: User | null = null

export function setCurrentUser(u: User) { currentUser = u }
export function getCurrentUser() { return currentUser }

// called at the start of every request, then read during render