What’s Vulnerable › Vulnerabilities
CVE-2026-32887: Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-20 · updated 2026-06-17
- Weakness: CWE-362
Description
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using `RpcServer.toWebHandler` (or `HttpApp.toWebHandlerRuntime`) inside a Next.js App Router route handler, any Node.js `AsyncLocalStorage`-dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, `auth()` from `@clerk/nextjs/server` returns a different user's session. Version 3.20.0 contains a fix for the issue.
Affected products
- Effect-TS effect: before 3.20.0 — fixed in 3.20.0
How to fix
Upgrade to a fixed version: Effect-TS effect 3.20.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-32887 or the next vulnerability affects your stack