{"id":"GHSA-chp3-j5qr-2vfr","summary":"Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()","details":"### Impact\n\nThe `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header.\n\nFor example, a `domain` of `\"legit.com; Domain=.parent.tld\"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None` or `Max-Age` when the caller has not set those options itself.\n\nThe `value` field is unaffected: it passes through `encodeURIComponent`, which encodes `;`. CR and LF are rejected by the existing regex, so header splitting is not possible.\n\n### Patches\n\nFixed in #6763 (v4) and #6765 (v3): the shared regex is split into per-field validators that reject `;`, and `serializeCookie()` now validates before writing the header.\n\n### Workarounds\n\nDo not pass user input into `name`, `domain`, or `path`; set them from application constants.","aliases":["CVE-2026-115779"],"modified":"2026-11-10T16:15:04.155939980Z","published":"2026-11-10T15:57:32Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-11-10T15:57:32Z","nvd_published_at":"2026-11-03T21:17:02Z","cwe_ids":["CWE-20","CWE-74"]},"references":[{"type":"WEB","url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115779"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/pull/6763"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/pull/6765"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"},{"type":"PACKAGE","url":"https://github.com/Effect-TS/effect"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"},{"type":"WEB","url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"}],"affected":[{"package":{"name":"@effect/platform","ecosystem":"npm","purl":"pkg:npm/%40effect/platform"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.97.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json"}},{"package":{"name":"effect","ecosystem":"npm","purl":"pkg:npm/effect"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-beta.0"},{"fixed":"4.0.0-beta.103"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}]}