ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32887

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications.

Published Mar 20, 2026 · updated Jun 17, 2026 · effectful effect

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using (or ) inside a Next.js App Router route handler, any Node.js -dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, from returns a different user's session. Version 3.20.0 contains a fix for the issue.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 20, 2026 · NIST NVD

    Detected

    Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using (or ) inside a Next.js App Router route handler, any Node.js -dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, from returns a different user's

  2. Jun 17, 2026 · NIST NVD

    Updated

    Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using (or ) inside a Next.js App Router route handler, any Node.js -dependent API called from within an Effect fiber can read another concurrent request's context — or no context at all. Under production traffic, from returns a different user's

Affected

  • cpe effectful/effectversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32887

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32887

    Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using (or ) inside a Next.js App Router route handler, any Node.js `Asy

    nvd.nist.gov

References