CVE-2026-32887: Effect AsyncLocalStorage context contamination in concurrent RPC handlers

CVE-2026-32887 · Severity: low · CVSS 3.1 · Published 2026-03-20

Effect's RPC and web handler implementation loses or mixes up AsyncLocalStorage (ALS) context between concurrent requests under load. This allows authentication functions (like Clerk's auth()) called within Effect fibers to read the wrong user's session data. In production with concurrent traffic, a user could gain unauthorized access to another customer's account or data by timing their requests to coincide with others' operations.

Technologies: effect (npm). Vendors: npm.

Quick answers

Is CVE-2026-32887 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32887 being exploited in the wild.
How severe is CVE-2026-32887?
Low severity, with a CVSS score of 3.1, published 20 March 2026.
Which products and versions are affected?
Effect-TS @Effect/Platform <= 0.94.2; Effect-TS @Effect/Rpc <= 0.72.1; Effect-TS RPC <= 0.72.1; effect (npm) SEMVER:introduced=0,fixed=3.20.0.
Is there a fix for CVE-2026-32887?
Yes. effect (npm): upgrade to 3.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32887 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32887?
Check whether you run Effect-TS @Effect/Platform, Effect-TS @Effect/Rpc, Effect-TS RPC or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • effect (npm): upgrade to 3.20.0 or later
    npm install effect@3.20.0

Technical details

Effect's MixedScheduler drains batched fiber continuations inside a single microtask or timer callback, inheriting the AsyncLocalStorage context of whichever request first triggered the drain cycle. The toWebHandlerRuntime function correctly sets Effect's own Context per-request but does not capture or restore Node.js AsyncLocalStorage context when forking fibers. Under concurrent load, when Request A triggers a scheduler drain, all subsequent continuations—including those from Request B—execute within Request A's ALS context. This affects any ALS-dependent APIs: calling auth() from @clerk/nextjs/server returns the wrong user's session, Next.js cookies() / headers() read the wrong request, and OpenTelemetry trace context crosses request boundaries. The vulnerability requires concurrent requests to the same handler and is highly likely to occur under production traffic. A fix was applied in Effect 3.20.0 or later to properly capture and restore ALS context at fiber fork/resume time.

Affected products

  • Effect-TS effect <= 3.19.15
  • Effect-TS @effect/rpc <= 0.72.1
  • Effect-TS @effect/platform <= 0.94.2

Identifiers

  • CVE-2026-32887
  • GHSA-38f7-945m-qr2g

Timeline

  • 2026-03-20: disclosed: Security advisory GHSA-38f7-945m-qr2g published
  • 2026-03-20: patched: Patch available in effect >= 3.20.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.