PT-2026-39241 · Npm+1 · Eventsource-Encoder

Rexxars · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44214

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions eventsource-encoder versions prior to 1.0.2

Description The software fails to sanitize the event and id fields of an EventSourceMessage before serialization in the encodeMessage() function. An attacker who controls these fields can inject Server-Sent Events (SSE) line terminators ( , r, or r ), allowing them to forge additional SSE fields or entire messages on the stream. This can lead to spoofing events of arbitrary types, injecting fields such as data:, id:, or retry:, splitting a single encoding call into multiple browser events, or overriding the client's Last-Event-ID.

Recommendations Update to version 1.0.2. As a temporary workaround, validate or strip line terminators from any untrusted value before passing it to the encode or encodeMessage() functions.

Exploit

Fix

Weakness Enumeration

CWE-113

CWE-93

Related Identifiers

CVE-2026-44214

GHSA-M9G3-3G99-MHPX

Affected Products

Eventsource-Encoder

References · 6

• 🔥 https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44214 · Security Note
• https://osv.dev/vulnerability/GHSA-m9g3-3g99-mhpx · Vendor Advisory
• https://github.com/rexxars/eventsource-encoder · Note
• https://t.me/CVEtracker/55023 · Telegram Post
• https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream · Note