CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Concurrent requests in Effect fibers can leak AsyncLocalStorage context, allowing attackers to read other users' session data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32887?
CVE-2026-32887 is a high-severity vulnerability in Effect-TS effect, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using `RpcServer.toWebHandler` (or `HttpApp.toWebHandlerRuntime`) inside a Next.js App Router route handler, any Node.js `AsyncLocalStorage`-dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, `auth()` from `@clerk/nextjs/server` returns a different user's session. Version 3.20.0 contains a fix for the issue.
Weakness: CWE-362
Which versions are affected by CVE-2026-32887?
2 open source packages ship an affected version, including effect. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
effect npm | All versions | 3.20.0 |
effect npm | All versions | 3.20.0 |
Products include Effectful Effect.
How do I fix CVE-2026-32887?
Upgrade effect to 3.20.0 or later.
Is CVE-2026-32887 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32887 exists.
Sources
Also known as CLEANSTART-2026-SJ56797, CLEANSTART-2026-XL99311, GHSA-38f7-945m-qr2g, MINI-7w9f-jqxm-5vx2, MINI-mxp7-hw7j-rg33, MINI-p5rm-68w7-fvc7.