<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://db.gcve.eu/rss/recent/all/10</id>
  <title>Most recent entries from all</title>
  <updated>2026-09-28T23:55:43.029626+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@gcve.eu</email>
  </author>
  <link href="https://db.gcve.eu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent entries.</subtitle>
  <entry>
    <id>https://db.gcve.eu/vuln/ghsa-38f7-945m-qr2g</id>
    <title>GHSA-38f7-945m-qr2g — Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC</title>
    <updated>2026-09-28T23:55:43.041745+00:00</updated>
    <content type="xhtml">
      <div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Affected:</strong> npm: effect</p>
<p>## Versions</p>
<p>- `effect`: 3.19.15
- `@effect/rpc`: 0.72.1
- `@effect/platform`: 0.94.2
- Node.js: v22.20.0
- Vercel runtime with Fluid compute
- Next.js: 16 (App Router)
- `@clerk/nextjs`: 6.x</p>
<p>## Root cause</p>
<p>Effect's `MixedScheduler` batches fiber continuations and drains them inside a **single** microtask or timer callback. The `AsyncLocalStorage` context active during that callback belongs to whichever request first triggered the scheduler's drain cycle — **not** the request that owns the fiber being resumed.</p>
<p>### Detailed mechanism</p>
<p>#### 1. Scheduler batching (`effect/src/Scheduler.ts`, `MixedScheduler`)</p>
<p>```typescript
// MixedScheduler.starve() — called once when first task is scheduled
private starve(depth = 0) {
  if (depth &gt;= this.maxNextTickBeforeTimer) {
    setTimeout(() =&gt; this.starveInternal(0), 0)       // timer queue
  } else {
    Promise.resolve(void 0).then(() =&gt; this.starveInternal(depth + 1)) // microtask queue
  }
}</p>
<p>// MixedScheduler.starveInternal() — drains ALL accumulated tasks in one call
private starveInternal(depth: number) {
  const tasks = this.tasks.buckets
  this.tasks.buckets = []
  for (const [_, toRun] of tasks) {
    for (let i = 0; i &lt; toRun.length; i++) {
      toRun[i]()  // ← Every fiber continuation runs in the SAME ALS context
    }
  }
  // ...
}
```</p>
<p>`scheduleTask` only calls `starve()` when `running` is `false`. Subsequent tasks accumulate in `this.tasks` until `starveInternal` drains them all. The `Promise.then()` (or `setTimeout`…</p></div>
    </content>
    <link href="https://db.gcve.eu/vuln/ghsa-38f7-945m-qr2g"/>
  </entry>
</feed>
