1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
effect-platform
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting effect-platform, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-chp3-j5qr-2vfr | Moderate | Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a `domain` of `"legit.com; Domain=.parent.tld"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None |
| GitHub (opens in a new tab) |
- GHSA-chp3-j5qr-2vfrModerateEffect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
>= 0.1.0, < 0.97.1
### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a `domain` of `"legit.com; Domain=.parent.tld"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None
CVE: CVE-2026-115779