CVE-2026-32887
High · 7.4CVSS
7.4
EPSS
0.3%
Published
Mar 20, 2026
CISA due date
—
The record
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using `RpcServer.toWebHandler` (or `HttpApp.toWebHandlerRuntime`) inside a Next.js App Router route handler, any Node.js `AsyncLocalStorage`-dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, `auth()` from `@clerk/nextjs/server` returns a different user's session. Version 3.20.0 contains a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | effect | 0 | 3.20.0 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Chainguard | langfuse-3 | 0 | 3.163.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3 | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.163.0-r0 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Wolfi | langfuse-3 | 0 | 3.163.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
Related vulnerabilities
- GHSA-38f7-945m-qr2g Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under… Same vulnerability
- CVE-2026-35209 defu is software that allows uers to assign default properties recursively. Also affects jitsucom-jitsu-console
- GHSA-737v-mqg7-c878 defu: Prototype pollution via `__proto__` key in defaults argument Also affects jitsucom-jitsu-console
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects jitsucom-jitsu-console
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects jitsucom-jitsu-console
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects jitsucom-jitsu-console
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects jitsucom-jitsu-console
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects jitsucom-jitsu-console