CVE-2026-32887: Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

March 20, 2026 (updated March 25, 2026)

Symptom	Severity
`auth()` returns wrong user’s session	Critical — authentication bypass
`cookies()` / `headers()` from Next.js read wrong request	High — data leakage
OpenTelemetry trace context crosses requests	Medium — incorrect traces
Works locally, fails in production	Hard to diagnose — only manifests under concurrent load

References

github.com/Effect-TS/effect
github.com/Effect-TS/effect/security/advisories/GHSA-38f7-945m-qr2g
github.com/advisories/GHSA-38f7-945m-qr2g
nvd.nist.gov/vuln/detail/CVE-2026-32887

Code Behaviors & Features

Detect and mitigate CVE-2026-32887 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →