{"id":"CVE-2026-115779","kind":"vulnerability","aliases":["CVE-2026-115779"],"related":[],"title":"Effect: cookie name and path fields let callers inject Set-Cookie attributes","description":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.","summary":"The Effect TypeScript framework's cookie helper writes caller-supplied name, domain and path values into Set-Cookie headers without escaping semicolons. An attacker who controls those values can append attributes such as a broader Domain, SameSite=None or Max-Age, widening a cookie's scope.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cookies","effect","node","package","typescript"],"not_affected_if":["encoded-values-only","fixed-cookie-settings","no-makecookie-usage"],"how_to_check":"- Check the installed version of `@effect/platform` and `effect` in the lockfile.\n- Search the code for calls to `makeCookie()` and see whether any name, domain or path argument comes from user input.","fix":"- `@effect/platform`: move to `0.97.1` or later.\n- `effect`: move to `4.0.0-beta.103` or later.","status":"open","published_at":"2026-11-03T21:17:02+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:20:43+00:00","updated_at":"2026-11-03T21:20:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:20:43Z","model":"claude-haiku-5-5","output":{"fix":"- `@effect/platform`: move to `0.97.1` or later.\n- `effect`: move to `4.0.0-beta.103` or later.","reach":"network","title":"Effect: cookie name and path fields let callers inject Set-Cookie attributes","impact":"low","summary":"The Effect TypeScript framework's cookie helper writes caller-supplied name, domain and path values into Set-Cookie headers without escaping semicolons. An attacker who controls those values can append attributes such as a broader Domain, SameSite=None or Max-Age, widening a cookie's scope.","audience":"developers","category":"package","nicknames":[],"who_cares":["typescript","effect","node","cookies"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker widens cookie scope or adds unset cookie attributes","analyst_note":"","how_to_check":"- Check the installed version of `@effect/platform` and `effect` in the lockfile.\n- Search the code for calls to `makeCookie()` and see whether any name, domain or path argument comes from user input.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-cookie-settings","encoded-values-only","no-makecookie-usage"],"who_is_affected":"Only applications that pass attacker-controlled values into makeCookie() for the name, domain or path fields are exposed. Apps that use fixed cookie settings or only encode cookie values are not affected by this flaw.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4369,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115779':16A,19A '-2026':15A,18A '0.1.0':94C '0.97.1':96C,187C '4.0.0':99C,102C,190C 'add':175C 'age':68B,156C 'allow':113C 'append':56B,134C 'applic':91C 'attack':50B,130C 'attacker-control':129C 'attribut':13A,57B,136C,180C 'beta.0':100C 'beta.103':103C,191C 'broader':61B,139C 'build':89C 'caller':8A,34B,126C,144C 'caller-suppli':33B 'charact':164C 'consist':80C 'control':52B,131C 'cooki':2A,12A,20B,30B,44B,71B,123C,135C,158C,171C,179C 'cr':161C 'cve':14A,17A 'delimit':115C 'domain':37B,62B,106C,140C 'effect':1A,21B,26B,74C,98C,189C 'effect/platform':93C,186C 'encod':157C 'escap':47B 'field':6A,109C 'fix':184C 'framework':28B,78C 'header':45B,124C 'help':88C 'helper':31B 'includ':137C 'inject':9A 'issu':182C 'let':7A 'lf':163C 'makecooki':112C 'max':67B,155C 'max-ag':66B,154C 'name':3A,36B,105C 'node':22B 'none':64B,152C 'option':149C 'otherwis':177C 'otherwise-unset':176C 'packag':23B,83C 'pass':110C 'path':5A,39B,108C 'remain':165C 'samesit':63B,151C 'scope':73B,173C 'semicolon':48B,114C 'serializecooki':117C 'set':11A,43B,122C,147C 'set-cooki':10A,42B,121C 'sever':82C 'suppli':35B,128C 'togeth':86C 'typescript':24B,27B,77C,90C 'unaffect':166C 'unset':178C 'valu':40B,54B,132C,159C 'verbatim':119C 'widen':69B,169C 'without':46B 'work':85C 'write':32B,118C","nicknames":[],"mitigations":[],"who_affected":"Only applications that pass attacker-controlled values into makeCookie() for the name, domain or path fields are exposed. Apps that use fixed cookie settings or only encode cookie values are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cookies","effect","medium","node","package","typescript"],"campaign_type":null,"first_public_at":"2026-10-30T05:04:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115779","severity":null,"published_at":"2026-11-03T21:17:02+00:00","modified_at":"2026-11-03T21:17:02+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null}],"documents":[{"id":60811,"url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60812,"url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60813,"url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60814,"url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60815,"url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-30T05:04:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}