Medium, CVSS 5.8npmAmendedPublished
eventsource-encoder vulnerable to SSE event injection via unsanitized event and id fields
CVE-2026-44214 · GHSA-m9g3-3g99-mhpx
- Affected
- npm eventsource-encoder <= 1.0.1
- Fixed in
- 1.0.2· Vendor fix available
- Issue
- eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to GHSA-4hxc-9384-m385 (h3), but the vulnerable fields are event/id rather than data/comment. These are less likely to be user-controllable, but should still be sanitized. Details In src/encode.ts, encodeMessage interpolates event and id into the output without inspecting them for line terminators: The SSE specification treats \r, \n, and \r\n as line terminators. A \n (or \r) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields. By contrast, data and comment already normalize all three line-terminator forms via NEWLINESRE = /(\r\n|\r|\n)/g, so they are not affected.…
Recommended action: Upgrade to 1.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.