The flaw is in Effect’s handling of AsyncLocalStorage within fibers. When multiple concurrent HTTP requests are processed, the request‑specific context can be lost or overwritten. Functions that rely on AsyncLocalStorage to retrieve the current request data, such as user authentication, may therefore read another request’s session or none at all. This can lead to incorrect user identity resolution, enabling an attacker to access resources with another user’s session data. The weakness corresponds to the concurrent modification race condition (CWE‑362).

The issue affects the Effect‑TS Effect framework, specifically the effect package, in all releases before version 3.20.0. The flaw manifests in Node.js environments that use the framework in a Next.js App Router route via RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime. Updating to 3.20.0 or newer removes the bug.

The CVSS score of 7.4 indicates high severity, while the EPSS score of <1 % suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known, actively exploited cases are documented. The attack vector is primarily via web requests handled by a Next.js application that relies on Effect fibers; an adversary would need to generate concurrent requests that trigger the race condition to cause context leakage.