medium5.8
CVE-2026-44214
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages.
Impact
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | eventsource-encoder | <= 1.0.1 | 1.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rexxars | Eventsource-Encoder | before 1.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-m9g3-3g99-mhpx
- https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx
- https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream
- https://nvd.nist.gov/vuln/detail/CVE-2026-44214