PT-2026-26681 · Effect Ts · Effect

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-32887

NVD

CVSS v3.1

7.4

High

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler (or HttpApp.toWebHandlerRuntime) inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, auth() from @clerk/nextjs/server returns a different user's session. Version 3.20.0 contains a fix for the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-32887

Affected Products

Effect

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-32887 · Security Note
• https://github.com/Effect-TS/effect/security/advisories/GHSA-38f7-945m-qr2g · Note