CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx	Exploit Mitigation Vendor Advisory
https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rexxars:eventsource-encoder:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-05-26 20:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-44214

Mitre link : CVE-2026-44214

CVE.ORG link : CVE-2026-44214

JSON object : View

Products Affected

rexxars

eventsource-encoder

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2026-44214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:19:24.561615Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rexxars", "product": "eventsource-encoder", "versions": [{"status": "affected", "version": "< 1.0.2"}]}]}], "published": "2026-05-26T20:16:19.803", "references": [{"url": "https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\\n, \\r, or \\r\\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2."}, {"lang": "es", "value": "eventsource-encoder codifica eventos como mensajes EventSource/Server Sent Event (SSE) bien formados. Antes de la versi\u00f3n 1.0.2, eventsource-encoder no sanitiza los campos 'event' o 'id' de un EventSourceMessage antes de serializarlos. Un atacante que controla cualquiera de los dos campos puede inyectar terminadores de l\u00ednea arbitrarios de Server-Sent Events (\\n, \\r, o \\r\\n) y de este modo forjar campos SSE adicionales o mensajes completos en el flujo. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.0.2."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rexxars:eventsource-encoder:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8177C5C4-DAA1-43A8-A156-EEE62C9080A1", "versionEndExcluding": "1.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}