CVE-2026-44217
CVE-2026-44217 · sse-channel: SSE Injection via unsanitized event fields
This page contains facts from public vulnerability sources. Check the original advisory before updating.
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.
CVSS 6.6 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sse-channel
- Versions
- < 4.0.1: Affected
No fix published
sse-channel npm
- Affected ranges
- SEMVER: < 4.0.1
Update to 4.0.1