CVE-2026-32887
Description
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using `RpcServer.toWebHandler` (or `HttpApp.toWebHandlerRuntime`) inside a Next.js App Router route handler, any Node.js `AsyncLocalStorage`-dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, `auth()` from `@clerk/nextjs/server` returns a different user's session. Version 3.20.0 contains a fix for the issue.
How to fix
- effectful effect3.20.0 or later
- effect3.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| effectful effect | v < 3.20.0 | 3.20.0 |
| effectnpm | v < 3.20.0 | 3.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.