CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.

• CWE-74

• https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2
• https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd
• https://github.com/Effect-TS/effect/pull/6763
• https://github.com/Effect-TS/effect/pull/6765
• https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1
• https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103
• https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11577Rejected reason: The reported behavior does not constitute a…
• CVE-2026-115770Pocket ID is an OIDC provider that allows users to authentic…9.6
• CVE-2026-115774Twisted is an event-based framework for internet application…4.9
• CVE-2026-115775Twisted is an event-based framework for internet application…8.7
• CVE-2026-115776Twisted is an event-based framework for internet application…7.5
• CVE-2026-115778Twisted is an event-based framework for internet application…7.5
• CVE-2026-11578The Fluent Forms WordPress plugin before 6.2.5 does not pro…2.7
• CVE-2026-115785An SMTP command injection vulnerability in the data-source t…4.3
• CVE-2026-115786A mailbox quota-accounting vulnerability in Zimbra Collabora…6.5
• CVE-2026-11579The Kali Forms — Contact Form & Drag-and-Drop Builder WordPr…5.3
• CVE-2026-115793P-Net before 1.0.3 does not release the RPC session allocate…8.7
• CVE-2026-115794P-Net before 1.0.3 passes the application alarm callback a d…2.3