diff --git a/src/box/lua/load_cfg.lua b/src/box/lua/load_cfg.lua
index 50b6e1b2c6fd35fec834874d8ced12804b398e95..04c422606e87b923764774cd7ae1dd3458d37dc7 100644
--- a/src/box/lua/load_cfg.lua
+++ b/src/box/lua/load_cfg.lua
@@ -5,6 +5,21 @@ local json = require('json')
 local private = require('box.internal')
 local urilib = require('uri')
 local math = require('math')
+local fiber = require('fiber')
+
+-- Function decorator that is used to prevent box.cfg() from
+-- being called concurrently by different fibers.
+local lock = fiber.channel(1)
+local function locked(f)
+    return function(...)
+        lock:put(true)
+        local status, err = pcall(f, ...)
+        lock:get()
+        if not status then
+            error(err)
+        end
+    end
+end
 
 -- all available options
 local default_cfg = {
@@ -409,7 +424,7 @@ local function load_cfg(cfg)
     -- Save new box.cfg
     box.cfg = cfg
     if not pcall(private.cfg_check)  then
-        box.cfg = load_cfg -- restore original box.cfg
+        box.cfg = locked(load_cfg) -- restore original box.cfg
         return box.error() -- re-throw exception from check_cfg()
     end
     -- Restore box members after initial configuration
@@ -423,7 +438,7 @@ local function load_cfg(cfg)
             __newindex = function(table, index)
                 error('Attempt to modify a read-only table')
             end,
-            __call = reload_cfg,
+            __call = locked(reload_cfg),
         })
     private.cfg_load()
     for key, fun in pairs(dynamic_cfg) do
@@ -439,7 +454,7 @@ local function load_cfg(cfg)
         box.schema.upgrade{auto = true}
     end
 end
-box.cfg = load_cfg
+box.cfg = locked(load_cfg)
 
 --
 -- This makes possible do box.sql.execute without calling box.cfg
diff --git a/test/replication/misc.result b/test/replication/misc.result
index ff0dbf5490da0ed3830a5a178ea6f502a3b37cbb..9d9d010c048ea2dc4d4c57c91e8c53daa4e99a58 100644
--- a/test/replication/misc.result
+++ b/test/replication/misc.result
@@ -23,6 +23,30 @@ box.cfg{replication = {'127.0.0.1:12345', box.cfg.listen}}
 - error: 'Incorrect value for option ''replication'': failed to connect to one or
     more replicas'
 ...
+-- gh-3606 - Tarantool crashes if box.cfg.replication is updated concurrently
+fiber = require('fiber')
+---
+...
+c = fiber.channel(2)
+---
+...
+f = function() fiber.create(function() pcall(box.cfg, {replication = {12345}}) c:put(true) end) end
+---
+...
+f()
+---
+...
+f()
+---
+...
+c:get()
+---
+- true
+...
+c:get()
+---
+- true
+...
 box.cfg{replication_timeout = replication_timeout, replication_connect_timeout = replication_connect_timeout}
 ---
 ...
diff --git a/test/replication/misc.test.lua b/test/replication/misc.test.lua
index c05e521659b5788e59b0c893bebd75610fdb3e26..da5a902398a117b7f118dfc80b1112e01ed698a2 100644
--- a/test/replication/misc.test.lua
+++ b/test/replication/misc.test.lua
@@ -9,6 +9,16 @@ replication_timeout = box.cfg.replication_timeout
 replication_connect_timeout = box.cfg.replication_connect_timeout
 box.cfg{replication_timeout=0.05, replication_connect_timeout=0.05, replication={}}
 box.cfg{replication = {'127.0.0.1:12345', box.cfg.listen}}
+
+-- gh-3606 - Tarantool crashes if box.cfg.replication is updated concurrently
+fiber = require('fiber')
+c = fiber.channel(2)
+f = function() fiber.create(function() pcall(box.cfg, {replication = {12345}}) c:put(true) end) end
+f()
+f()
+c:get()
+c:get()
+
 box.cfg{replication_timeout = replication_timeout, replication_connect_timeout = replication_connect_timeout}
 
 -- gh-3111 - Allow to rebootstrap a replica from a read-only master