CVE-2026-44217

描述

### Impact Implementations that allows user-provided values to be passed to `event`, `retry` or `id` fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. - **Event Spoofing:** Attacker can inject arbitrary SSE events into the stream - **Client-side Manipulation:** Injected events can trigger unintended behavior in frontend JavaScript EventSource listeners - **Data Integrity:** Consumers of the SSE stream cannot distinguish injected events from legitimate ones ### Patches Patch available in v4.0.1. ### Workarounds Do not allow user data to control `event`, `retry` or `id` fields, and if you must - sanitize the input before passing it to `sse-channel`, stripping any newlines. ### Resources https://github.com/rexxars/sse-channel/issues/42

如何修補 CVE-2026-44217

要修補 CVE-2026-44217,請將受影響套件升級到下列已修補版本。

• —升級至 4.0.1 或更新版本

CVE-2026-44217 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 4.0.1

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-44217
• PATCHgithub.com/rexxars/sse-channel
• WEBgithub.com/rexxars/sse-channel/issues/42
• WEBgithub.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg