GHSA-38f7-945m-qr2g
High · 7.4CVSS
7.4
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | effect | 0 | 3.20.0 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Chainguard | langfuse-3 | 0 | 3.163.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3 | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.163.0-r0 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Wolfi | langfuse-3 | 0 | 3.163.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
Related vulnerabilities
- CVE-2026-32887 Effect is a TypeScript framework that consists of several packages that work together to… Same vulnerability
- CVE-2026-35209 defu is software that allows uers to assign default properties recursively. Also affects jitsucom-jitsu-console
- GHSA-737v-mqg7-c878 defu: Prototype pollution via `__proto__` key in defaults argument Also affects jitsucom-jitsu-console
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects jitsucom-jitsu-console
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects jitsucom-jitsu-console
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects jitsucom-jitsu-console
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects jitsucom-jitsu-console
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects jitsucom-jitsu-console