Read the docs
TI-2026-84578 Aliases CVE-2026-115779

Effect: Cookie attribute injection via makeCookie() name, domain and path fields

Priority LOW 29CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Effect's @effect/platform from 0.1.0 before 0.97.1 and effect from 4.0.0-beta.0 before 4.0.0-beta.103 do not neutralize semicolon delimiters in the name, domain and path fields passed to makeCookie(), and serializeCookie() writes these values verbatim into Set-Cookie headers. When a caller supplies attacker-controlled values, an attacker can append a broader Domain, or SameSite=None or Max-Age when the caller has not set those options. Encoded cookie values and CR or LF characters are not affected. The weakness is CWE-74, the CVSS 4.0 base score is 6.3 (MEDIUM), and CISA has not listed it in KEV and no exploit is referenced.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00627 50th percentileScored 2026-11-07
Fix Fixed effect (Effect-TS): 4.0.0-beta.103platform (@effect): 0.97.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Effect-TSeffect4.0.0-beta.0 to before 4.0.0-beta.1034.0.0-beta.103Patch availableCNA
@effectplatform0.1.0 to before 0.97.10.97.1Patch availableCNA
  • effect VendorEffect-TS Affected 4.0.0-beta.0 to before 4.0.0-beta.103 Fixed in 4.0.0-beta.103 Patch available CNA
  • platform Vendor@effect Affected 0.1.0 to before 0.97.1 Fixed in 0.97.1 Patch available CNA

Remediation

Upgrade @effect/platform to 0.97.1 or later, and effect to 4.0.0-beta.103 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA effect (Effect-TS) Fixed in 4.0.0-beta.103
  • Fix · CNA platform (@effect) Fixed in 0.97.1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-115779
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences