{"id":"CVE-2026-115779","title":"Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()","summary":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and pat…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-74"],"vendor":"Effect-TS","product":"effect","affected":["effect >= 4.0.0-beta.0, < 4.0.0-beta.103","platform >= 0.1.0, < 0.97.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T21:26:42.883505Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T21:26:55.431Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115779","references":[{"url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr","label":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"},{"url":"https://github.com/Effect-TS/effect/pull/6763","label":"https://github.com/Effect-TS/effect/pull/6763"},{"url":"https://github.com/Effect-TS/effect/pull/6765","label":"https://github.com/Effect-TS/effect/pull/6765"},{"url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2","label":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"},{"url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd","label":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"},{"url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1","label":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"},{"url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103","label":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"}],"tags":["cve.org"],"epss":0.00627,"epssPercentile":0.50315,"ingestedAt":"2026-11-05T20:33:06.524Z","slug":"CVE-2026-115779","body":"## Overview\n\nEffect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.\n\n## Affected\n\n- `effect >= 4.0.0-beta.0, < 4.0.0-beta.103`\n- `platform >= 0.1.0, < 0.97.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}