CVE-2026-44217

Description

### Impact Implementations that allows user-provided values to be passed to `event`, `retry` or `id` fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. - **Event Spoofing:** Attacker can inject arbitrary SSE events into the stream - **Client-side Manipulation:** Injected events can trigger unintended behavior in frontend JavaScript EventSource listeners - **Data Integrity:** Consumers of the SSE stream cannot distinguish injected events from legitimate ones ### Patches Patch available in v4.0.1. ### Workarounds Do not allow user data to control `event`, `retry` or `id` fields, and if you must - sanitize the input before passing it to `sse-channel`, stripping any newlines. ### Resources https://github.com/rexxars/sse-channel/issues/42

How to fix CVE-2026-44217

To remediate CVE-2026-44217, upgrade the affected package to a fixed version below.

• —upgrade to 4.0.1 or later

Is CVE-2026-44217 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 4.0.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-44217
• PATCHgithub.com/rexxars/sse-channel
• WEBgithub.com/rexxars/sse-channel/issues/42
• WEBgithub.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg