CVE-2026-44214 Details
Description
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
A vulnerability exists in eventsource-encoder versions prior to 1.0.2, where the encoder fails to properly sanitize the event and id fields of an EventSourceMessage before serialization. This lack of validation allows an attacker to inject arbitrary Server-Sent Events line terminators, forging additional SSE fields or entire messages on the stream. The issue arises because the SSE specification treats certain line endings as terminators, enabling manipulation of the event stream.
Upgrade to eventsource-encoder version 1.0.2 or later, where the event and id fields are properly validated to prevent the injection of line terminators.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rexxars eventsource-encoder | < 1.0.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |