Vulnerability · Published May 26, 2026 · Assigned by GitHub_M
CVE-2026-44214eventsource-encoder: SSE event injection via unsanitized event and id fields
Medium 5.8
In plain English
A medium-severity security flaw in eventsource-encoder from rexxars. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | eventsource-encoder | 1.0.2 | GHSA-m9g3-3g99-mhpx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rexxars | eventsource-encoder | < 1.0.2 |
Weakness: CWE-93, CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N