CVE-2026-32887: Effect Package AsyncLocalStorage Context Contamination Under Concurrent Load
Summary
CVE-2026-32887: Versions - effect: 3.19.15 - @effect/rpc: 0.72.1 - @effect/platform: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 (App Router) - @clerk/nextjs: 6.x Root cause Effect's MixedScheduler batch... Affects effect versions < 3.20.0. Fixed in 3.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Effect package is a powerful library designed for building asynchronous and concurrent applications in JavaScript, particularly in Node.js environments. It provides a structured way to manage side effects, enabling developers to write clean and maintainable code. However, a vulnerability has been identified that affects the handling of AsyncLocalStorage contexts, leading to potential data leakage and authentication bypass under concurrent load scenarios.
Vulnerability Detail
The vulnerability arises from the MixedScheduler component of the Effect package, which batches fiber continuations and executes them within a single microtask or timer callback. This design flaw allows the AsyncLocalStorage context to be shared across different requests, leading to scenarios where one request can access the context of another. As a result, sensitive information such as user authentication data may be exposed, allowing unauthorized access to user sessions and other critical data. This issue is particularly severe under high concurrency, where multiple requests are processed simultaneously.
How To Fix
Minimum fixed version
3.20.0
This is the first release that contains the fix.
npm install effect@3.20.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, capture AsyncLocalStorage-dependent values before entering the Effect runtime and pass them via Effect's context system. Here is an example of how to implement this workaround:
// In the route handler — OUTSIDE the Effect fiber (ALS is correct here)
export const POST = async (request: Request) => {
const { userId } = await auth(); // Safe: still in Next.js ALS context
// Inject into request headers or use the context parameter
const headers = new Headers(request.headers);
headers.set("x-clerk-auth-user-id", userId ?? "");
const enrichedRequest = new Request(request.url, {
method: request.method,
headers,
body: request.body,
duplex: "half" as any,
});
return webHandler(enrichedRequest);
};
// In Effect handlers — read from HttpServerRequest headers instead of calling auth()
const getAuthenticatedUserId = Effect.gen(function*() {
const req = yield* HttpServerRequest.HttpServerRequest;
const userId = req.headers["x-clerk-auth-user-id"];
if (!userId) return yield* Effect.fail(new UnauthorizedError({ message: "Auth required" }));
return userId;
});
Conclusion
The CVE-2026-32887 vulnerability in the Effect package poses significant risks under concurrent load, allowing for potential data leakage and authentication issues. It is crucial to update to the patched version 3.20.0 or later to safeguard your application. Implementing the suggested workaround can also help mitigate risks until an update is feasible.
See every vulnerability recorded for effect →
FAQ
CVE-2026-32887 is a vulnerability in the Effect package that allows AsyncLocalStorage context contamination under concurrent load, potentially leading to data leakage and authentication bypass.
The vulnerability can cause your application to return incorrect user sessions, leading to unauthorized access and data leakage, especially under high concurrency.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, implement the provided workaround to mitigate the risk of context contamination until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for effect.
