---
id: "CVE-2026-115779"
kind: "vulnerability"
aliases: ["CVE-2026-115779"]
title: "Effect: cookie name and path fields let callers inject Set-Cookie attributes"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cookies", "effect", "node", "package", "typescript"]
not_affected_if: ["encoded-values-only", "fixed-cookie-settings", "no-makecookie-usage"]
published_at: "2026-11-03T21:17:02+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:20:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115779", "first_seen_at": "2026-11-03T21:19:08+00:00"}]
---

# Effect: cookie name and path fields let callers inject Set-Cookie attributes

The Effect TypeScript framework's cookie helper writes caller-supplied name, domain and path values into Set-Cookie headers without escaping semicolons. An attacker who controls those values can append attributes such as a broader Domain, SameSite=None or Max-Age, widening a cookie's scope.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@effect/platform` and `effect` in the lockfile.
- Search the code for calls to `makeCookie()` and see whether any name, domain or path argument comes from user input.

## Fix

- `@effect/platform`: move to `0.97.1` or later.
- `effect`: move to `4.0.0-beta.103` or later.

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115779

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr
- [fix] Patch: github.com https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2
- [fix] Patch: github.com https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd
- [fix] Release notes: github.com https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1
- [fix] Release notes: github.com https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103

## From the sources

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_