{"id":"CVE-2026-115779","aliases":["GHSA-chp3-j5qr-2vfr"],"url":"https://o3.security/vulnerability/CVE-2026-115779","summary":"Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()","details":"### Impact\n\nThe `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header.\n\nFor example, a `domain` of `\"legit.com; Domain=.parent.tld\"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None` or `Max-Age` when the caller has not set those options itself.\n\nThe `value` field is unaffected: it passes through `encodeURIComponent`, which encodes `;`. CR and LF are rejected by the existing regex, so header splitting is not possible.\n\n### Patches\n\nFixed in #6763 (v4) and #6765 (v3): the shared regex is split into per-field validators that reject `;`, and `serializeCookie()` now validates before writing the header.\n\n### Workarounds\n\nDo not pass user input into `name`, `domain`, or `path`; set them from application constants.","published":"2026-11-03T20:40:19.864Z","modified":"2026-11-05T03:29:50.955130028Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@effect/platform","fixedVersion":"0.97.1"},{"ecosystem":"npm","name":"effect","fixedVersion":"4.0.0-beta.103"}],"fix":{"url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2","label":"Effect-TS/effect@4a57af2"},"references":[{"type":"WEB","url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115779.json"},{"type":"ADVISORY","url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115779"},{"type":"FIX","url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"},{"type":"FIX","url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"},{"type":"FIX","url":"https://github.com/Effect-TS/effect/pull/6763"},{"type":"FIX","url":"https://github.com/Effect-TS/effect/pull/6765"},{"type":"PACKAGE","url":"https://github.com/Effect-TS/effect"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:29:50.955130028Z"}}