A race condition in the Effect-TS framework, affecting versions prior to 3.20.0, presents a critical risk of cross-request data leakage and potential session hijacking for users of Next.js.

This vulnerability is a race condition (CWE-362) occurring when using specific web handler functions in Next.js. The flaw allows unauthenticated attackers to trigger context leakage, where Node.js AsyncLocalStorage data is incorrectly shared between concurrent request fibers, potentially exposing sensitive session information.

The exploitation of this vulnerability can result in severe unauthorized access, as sensitive user session data may be served to the wrong concurrent request. Given the CVSS score of 7.4, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially enabling attackers to impersonate other users within affected applications.

Immediate Action: Update the effect package to version 3.20.0 or later to ensure proper synchronization of request context.

Proactive Monitoring: Review application access logs for anomalous session behavior or unexpected user identification patterns during periods of high concurrent traffic.

Compensating Controls: If immediate patching is not feasible, restrict concurrent request processing or implement additional validation layers within the application logic to ensure session context integrity.

Public Exploit Available: Unknown.

Organizations utilizing the Effect-TS framework within Next.js environments must prioritize upgrading to version 3.20.0 immediately. The potential for cross-request session leakage represents a significant security failure that cannot be reliably mitigated by external controls alone. Ensure all dependencies are updated to the specified version to fully remediate this race condition.