CVE-2026-115779

Name of the Vulnerable Software and Affected Versions @effect/platform versions 0.1.0 through 0.97.0 effect versions 4.0.0-beta.0 through 4.0.0-beta.102

Description The makeCookie() function allows semicolon delimiters in the name, domain, and path fields, which the serializeCookie() function then writes verbatim into Set-Cookie headers. If an attacker can control these values, they may append cookie attributes such as a broader Domain, SameSite=None, or Max-Age. This can result in widening the scope of a cookie or adding attributes that were not originally intended.

Recommendations Update @effect/platform to version 0.97.1. Update effect to version 4.0.0-beta.103.