CVE-2026-115779

The record

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.

Affected packages

Related vulnerabilities

• CVE-2026-121524 A flaw has been found in sumiie24 School-Management-System up to… CWE-74
• CVE-2026-121502 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. CWE-74
• CVE-2026-57154 OPNsense is a FreeBSD based firewall and routing platform. CWE-74
• CVE-2026-121260 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. CWE-74
• CVE-2026-120329 Saving the configuration of the mail backend module writes submitted settings to the page… CWE-74
• CVE-2026-120349 A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. CWE-74
• CVE-2026-120348 A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. CWE-74
• CVE-2026-120347 A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. CWE-74