CVE-2026-32887 Details

A vulnerability exists in the Effect TypeScript framework, specifically in versions through 3.19.15, when used with Next.js App Router. The issue arises in the RPC server handling, where the Node.js AsyncLocalStorage context can be improperly shared between concurrent requests. This flaw allows an Effect fiber to access another request's context or none at all, leading to critical authentication errors. For instance, the auth() function from @clerk/nextjs/server may return a session for a different user under production traffic. The root cause lies in Effect's MixedScheduler, which batches and executes fiber continuations in a way that mismanages the AsyncLocalStorage context, especially during concurrent loads.

Users can work around this vulnerability by capturing AsyncLocalStorage-dependent values before entering the Effect runtime and passing them through Effect's context system. For example, extract the user ID from the request headers using the auth() function before processing the request with Effect, and then inject this information into the Effect context or request headers for use within the Effect handlers.