3vulnerabilities
- Critical1 (33.3%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
effect
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting effect, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-chp3-j5qr-2vfr | Moderate | Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a `domain` of `"legit.com; Domain=.parent.tld"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None |
| GitHub (opens in a new tab) | |
| GHSA-38f7-945m-qr2g | High | Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC## Versions - `effect`: 3.19.15 - `@effect/rpc`: 0.72.1 - `@effect/platform`: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 (App Router) - `@clerk/nextjs`: 6.x ## Root cause Effect's `MixedScheduler` batches fiber continuations and drains them inside a **single** microtask or timer callback. The `AsyncLocalStorage` context active during that callback belongs to whichever request first triggered the scheduler's drain cycle — **not** the request that owns the fiber being resumed. ### Detailed mechanism #### 1. Scheduler batching (`effect/src/Scheduler.ts`, `Mi |
| GitHub (opens in a new tab) | |
| GHSA-6hr9-4692-fch9 | Critical | Withdrawn Advisory: OS Command Injection in effect## Withdrawn Advisory This advisory has been withdrawn because the [npm package effect](https://www.npmjs.com/package/effect), for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any [supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#github-reviewed-advisories). Additionally, the CVE Numbering Authority that issued the CVE for CV |
| GitHub (opens in a new tab) |
- GHSA-chp3-j5qr-2vfrModerateEffect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
>= 4.0.0-beta.0, < 4.0.0-beta.103
### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a `domain` of `"legit.com; Domain=.parent.tld"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None
CVE: CVE-2026-115779
- GHSA-38f7-945m-qr2gHighEffect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
< 3.20.0
## Versions - `effect`: 3.19.15 - `@effect/rpc`: 0.72.1 - `@effect/platform`: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 (App Router) - `@clerk/nextjs`: 6.x ## Root cause Effect's `MixedScheduler` batches fiber continuations and drains them inside a **single** microtask or timer callback. The `AsyncLocalStorage` context active during that callback belongs to whichever request first triggered the scheduler's drain cycle — **not** the request that owns the fiber being resumed. ### Detailed mechanism #### 1. Scheduler batching (`effect/src/Scheduler.ts`, `Mi
CVE: CVE-2026-32887
- GHSA-6hr9-4692-fch9CriticalWithdrawn Advisory: OS Command Injection in effect
<= 1.0.4
## Withdrawn Advisory This advisory has been withdrawn because the [npm package effect](https://www.npmjs.com/package/effect), for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any [supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#github-reviewed-advisories). Additionally, the CVE Numbering Authority that issued the CVE for CV
CVE: CVE-2020-7624