High, CVSS 7.4npmAmendedPublished
Effect AsyncLocalStorage context lost/contaminated inside Effect fibers under concurrent load with RPC
CVE-2026-32887 · GHSA-38f7-945m-qr2g
- Affected
- npm effect < 3.20.0
- Fixed in
- 3.20.0· Vendor fix available
- Issue
- Versions - effect: 3.19.15 - @effect/rpc: 0.72.1 - @effect/platform: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 (App Router) - @clerk/nextjs: 6.x Root cause Effect's MixedScheduler batches fiber continuations and drains them inside a single microtask or timer callback. The AsyncLocalStorage context active during that callback belongs to whichever request first triggered the scheduler's drain cycle — not the request that owns the fiber being resumed. Detailed mechanism 1. Scheduler batching (effect/src/Scheduler.ts, MixedScheduler) scheduleTask only calls starve() when running is false. Subsequent tasks accumulate in this.tasks until starveInternal drains them all. The Promise.then() (or setTimeout) callback inherits the ALS context from whichever call site created it — i.e., whichever request's fiber first set running = true. Result: Under concurrent load, fiber continuations from Request A and Request B execute inside the same starveInternal call,…
Recommended action: Upgrade to 3.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.