In general, only "method" variables (declared in <% %>

are definitively thread safe in JSPs.
Class ("static") variables are not. Object (instance) variables are not. Variables stored in application and session contexts are not. Variables stored in request or page contexts are probably thread safe, unless they are also one of the unsafe categories above.