Vulnerability Description
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rexxars | Eventsource-Encoder | < 1.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g9ExploitMitigationVendor Advisory
- https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g9ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-44214?
CVE-2026-44214 is a vulnerability with a CVSS score of 5.8 (MEDIUM). eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage be...
How severe is CVE-2026-44214?
CVE-2026-44214 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44214?
Check the references section above for vendor advisories and patch information. Affected products include: Rexxars Eventsource-Encoder.