Effect-TS effect vulnerabilities

Latest Effect-TS effect CVEs

Newest publication first

1. CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

   Published 2026-11-03

   Medium·CVSS 6.3

   Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semic...

2. CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

   Published 2026-03-20

   High·CVSS 7.4

   Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler (or HttpApp.toWebHandlerRuntime) inside a Next.js App Router route handler, any Node.js AsyncLoc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.