CVE-2026-32887 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse-fips, langfuse...

CVE-2026-32887

The Connected document details a concurrency vulnerability in the Effect ecosystem where AsyncLocalStorage (ALS) context is not properly propagated across fibers in a web handler under concurrent load. Root cause: a scheduler drains multiple fiber continuations in a single drain cycle, causing AL...

@2digits/tlo-mcp (>=0.1.0 <=0.1.10), @6qat/tcp-connection (>=0.2.6 <=0.2.9) +874 more potentially affected by CVE-2026-32887 via effect (>=2.0.0-next.10 <=3.1.6)

effect NPM version =2.0.0-next.10, =0.1.0, =0.2.6, =1.0.0, =0.1.0-alpha.1, =0.0.1, =0.1.0-alpha.1, =0.0.1, =0.0.5, =0.0.1, =0.1.0, =0.2.1, =0.4.2 - @arvkonstantin/framework-provider-local-pg =3.4.3 - @awstin/effect-zero-v3 =0.1.0 and more Source cves: CVE-2026-32887 Source advisory:...