CVE-2026-115779
— UNSCOREDpublic exploit availablePublished 2026-11-03 · Updated 2026-11-03
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.
Weaknesses
CWE-74
Public exploit & PoC references
- https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2
- https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd
- https://github.com/Effect-TS/effect/pull/6763
- https://github.com/Effect-TS/effect/pull/6765
- https://github.com/Effect-TS/effect/releases/tag/@effect/[email protected]
- https://github.com/Effect-TS/effect/releases/tag/[email protected]
- https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr
All references
- https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2
- https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd
- https://github.com/Effect-TS/effect/pull/6763
- https://github.com/Effect-TS/effect/pull/6765
- https://github.com/Effect-TS/effect/releases/tag/@effect/[email protected]
- https://github.com/Effect-TS/effect/releases/tag/[email protected]
- https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100312PoC
- HIGHCVE-2026-100314PoC
- HIGHCVE-2026-100315PoC
- HIGHCVE-2026-100739PoC
- HIGHCVE-2026-100874PoC
- HIGHCVE-2026-100875PoC
- MEDIUMCVE-2026-100887PoC
- MEDIUMCVE-2026-100894PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.