CVE-2026-115779

Received Received - Intake

Cookie Attribute Injection in Effect Framework

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-115779

EUVD

EUVD-2026-116496

Affected Vendors & Products

Vendor	Product	Version / Range
Effect-TS	effect	>= 4.0.0-beta.0, < 4.0.0-beta.103
@effect	platform	>= 0.1.0, < 0.97.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Effect TypeScript framework versions between @effect/platform 0.1.0 and 0.97.1 and effect 4.0.0-beta.0 and 4.0.0-beta.103. It allows semicolon delimiters in cookie fields passed to makeCookie(), which are then written directly into Set-Cookie headers. Attackers can exploit this to append cookie attributes like Domain, SameSite=None, or Max-Age, potentially widening a cookie's scope or adding unset attributes.

Detection Guidance

This vulnerability can be detected by inspecting Set-Cookie headers for semicolon delimiters in cookie attributes. Check applications using @effect/platform versions 0.1.0 to 0.97.1 or effect versions 4.0.0-beta.0 to 4.0.0-beta.103. Use tools like curl to fetch headers and look for unexpected cookie attributes.

Impact Analysis

An attacker could manipulate cookies to extend their scope beyond intended domains or set attributes like SameSite=None, which may enable session hijacking or cross-site request forgery attacks. This could lead to unauthorized access to user sessions or sensitive data if cookies are used for authentication or tracking.

Mitigation Strategies

Immediately update @effect/platform to version 0.97.1 or later and effect to version 4.0.0-beta.103 or later. Review and sanitize any user-controlled inputs passed to makeCookie() to prevent semicolon injection. Monitor Set-Cookie headers for suspicious attributes.

Hi! I’m here to help you understand CVE-2026-115779. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...