CVE-2026-32887: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32887 is an AsyncLocalStorage (ALS) context contamination vulnerability in the Effect TypeScript framework that enables authentication bypass under concurrent load. When using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, Node.js ALS-dependent APIs called from within Effect fibers can read another concurrent request's context — or no context at all. This affects all versions of the effect npm package prior to 3.20.0. It was published on March 20, 2026, with a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Effect-TS Advisory).

The root cause is a race condition (CWE-362) in Effect's MixedScheduler, which batches fiber continuations and drains them all inside a single microtask or timer callback (starveInternal). The ALS context captured for that callback belongs to whichever request first triggered the scheduler's drain cycle (starve()), not the request owning each individual fiber. Compounding this, toWebHandlerRuntime in @effect/platform/src/HttpApp.ts correctly sets Effect's own per-request context but does not capture or restore the Node.js ALS context when forking fibers. As a result, under concurrent load, when Request B's fiber continuation executes inside the same starveInternal call as Request A's, any ALS-dependent call (e.g., auth() from @clerk/nextjs/server) reads Request A's session instead of Request B's (Effect-TS Advisory).

The primary impact is authentication bypass: under production concurrent traffic, auth() from @clerk/nextjs/server can return a different user's session, allowing one user to access another user's data or perform actions as that user. Secondary impacts include data leakage via cookies() and headers() from Next.js reading the wrong request's values, and cross-request OpenTelemetry trace context contamination. The vulnerability only manifests under concurrent load and is not reproducible in single-request local testing, making it particularly difficult to detect before production deployment (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit is publicly available. The advisory includes a minimal reproduction demonstrating the bug locally within the library, but it does not provide actionable steps to attack a deployed system (Effect-TS Advisory). The EPSS score is approximately 0.009% (0.000090), placing it in the 3rd percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires high attack complexity — specifically, the ability to send concurrent requests to a vulnerable endpoint — but requires no privileges or user interaction (GitHub Advisory).

1. Identify a vulnerable target: Locate a Next.js App Router application using the effect npm package (version < 3.20.0) with RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime in a route handler, and that calls ALS-dependent APIs (e.g., auth() from @clerk/nextjs/server) inside Effect fibers.
2. Craft concurrent requests: Send two or more simultaneous HTTP POST requests to the vulnerable RPC endpoint (e.g., /api/rpc/demo) from different sessions or as different users, ensuring they arrive close enough in time to be batched by Effect's MixedScheduler.
3. Trigger scheduler batching: The first request's fiber sets running = true and calls starve(), capturing its ALS context in the microtask queue. The second request's fiber queues its continuation without creating a new drain cycle.
4. Observe context contamination: When starveInternal() fires, it drains all accumulated fiber continuations under the first request's ALS context. Any ALS-dependent call in the second request's fiber (e.g., auth()) returns the first request's session data.
5. Access unauthorized data: Use the incorrectly returned session (e.g., a different user's userId) to retrieve or manipulate that user's data via subsequent API calls (Effect-TS Advisory).

• Logs: Application logs showing authentication calls returning unexpected or mismatched user IDs relative to the session token presented in the request; repeated auth errors or UnauthorizedError for requests that should succeed.
• Application Behavior: Users reporting access to another user's data or receiving another user's session information; OpenTelemetry traces showing spans from different users merged into the same trace.
• Network: Bursts of concurrent POST requests to RPC endpoints (e.g., /api/rpc/*) from multiple distinct clients arriving within the same millisecond window, potentially indicating deliberate timing attacks.
• Runtime: Node.js process logs indicating AsyncLocalStorage.getStore() returning undefined or unexpected values during high-concurrency periods on Effect-based RPC handlers (Effect-TS Advisory).

Upgrade the effect npm package to version 3.20.0 or later, which contains the fix for ALS context propagation (GitHub Advisory). If an immediate upgrade is not possible, apply the documented workaround: extract ALS-dependent values (e.g., call auth()) outside the Effect runtime in the Next.js route handler, then inject the result into the request headers before passing to webHandler. Inside Effect handlers, read the injected value from HttpServerRequest headers rather than calling ALS-dependent APIs directly. This ensures ALS-sensitive calls execute in the correct Next.js context before entering the Effect fiber scheduler (Effect-TS Advisory).

The vulnerability was reported by community member jamesone and published by Effect maintainer mikearnaldi on March 20, 2026. The advisory includes a detailed root cause analysis, reproduction timeline, and multiple suggested fix options (ALS snapshot propagation in the scheduler, per-fiber ALS capture at runFork, or a documented context injection API), reflecting thorough engagement from both the reporter and maintainers. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory (Effect-TS Advisory).