GitHub Advisoryadvisory · npm
GHSA-84hm-wfh8-c5pg sse-channel: SSE Injection via unsanitized event fields
MEDIUM
Official page ↗
- Aliases
- CVE-2026-44217
- Ecosystem
- npm
- Packages
- sse-channel
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-93
- Reviewed
- 2026-05-05
Affected packages
• npm sse-channel: < 4.0.1 → fixed in 4.0.1
Description
Impact
Implementations that allows user-provided values to be passed to `event`, `retry` or `id` fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream.
• Event Spoofing: Attacker can inject arbitrary SSE events into the stream
• Client-side Manipulation: Injected events can trigger unintended behavior in frontend JavaScript EventSource listeners
• Data Integrity: Consumers of the SSE stream cannot distinguish injected events from legitimate ones
Patches
Patch available in v4.0.1.
Workarounds
Do not allow user data to control `event`, `retry` or `id` fields, and if you must - sanitize the input before passing it to `sse-channel`, stripping any newlines.
Resources
https://github.com/rexxars/sse-channel/issues/42
Related
Alias · CVE (1)
- CVE-2026-44217 sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. vulnerability
Weakness · CWE (1)
- CWE-93 Improper Neutralization of CRLF Sequences weakness