Effect framework can lose or mix Node.js AsyncLocalStorage context during concurrent RPC calls in a Next.js App Router route, causing wrapped APIs such as auth() from @clerk/nextjs/server to return a different user’s session or no session at all. This flaw is a race condition type weakness that can expose another user's data or allow successful use of another user’s privileges in a production environment.

Products: Effect-TS:effect (all packages that include RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime). An affected release is any version prior to 3.20.0. If your application incorporates Effect-TS in a Next.js App Router route handler, the vulnerability applies. No other vendor or platform is explicitly enumerated in the advisory.

The vulnerability scores a CVSS base of 7.4, classifying it as high severity. The EPSS score is not published, but the flaw is exploit‑sensitive to concurrent load, which is common in production traffic. Since the issue is not currently listed in CISA’s KEV catalog, known exploits are not publicly reported. An attacker would need to generate concurrent requests that trigger the AsyncLocalStorage mix‑up; once exploited, the attacker could read other user sessions or elevate privileges. The lack of a public exploit does not reduce the risk when usage patterns permit the required concurrency.