CVE-2026-32887
AsyncLocalStorage Context Leak in Effect Framework Causes Session Mix-up
Publication date: 2026-03-20
Last updated on: 2026-04-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| effectful | effect | to 3.20.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Effect TypeScript framework prior to version 3.20.0. When using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent API called within an Effect fiber can incorrectly read the context of another concurrent request or no context at all.
This means that under production traffic, the auth() function from @clerk/nextjs/server may return a different user's session than expected, leading to potential session confusion.
The issue was fixed in version 3.20.0 of the Effect framework.
How can this vulnerability impact me? :
This vulnerability can lead to serious security issues where one user's request context is mixed up with another's.
Specifically, it can cause the authentication function to return the wrong user's session, potentially allowing unauthorized access to another user's data or actions.
Such session confusion can result in data leakage, unauthorized operations, and compromise of user privacy.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the Effect TypeScript framework to version 3.20.0 or later, which contains the fix for the issue where AsyncLocalStorage-dependent APIs could leak context between concurrent requests.