GHSA-84hm-wfh8-c5pg

Source

https://github.com/advisories/GHSA-84hm-wfh8-c5pg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-84hm-wfh8-c5pg/GHSA-84hm-wfh8-c5pg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-84hm-wfh8-c5pg

Aliases

CVE-2026-44217

Published

2026-05-05T22:17:02Z

Modified

2026-05-13T16:46:23.718132Z

Severity

6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

sse-channel: SSE Injection via unsanitized event fields

Details

Impact

Implementations that allows user-provided values to be passed to event, retry or id fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream.

Event Spoofing: Attacker can inject arbitrary SSE events into the stream
Client-side Manipulation: Injected events can trigger unintended behavior in frontend JavaScript EventSource listeners
Data Integrity: Consumers of the SSE stream cannot distinguish injected events from legitimate ones

Patches

Patch available in v4.0.1.

Workarounds

Do not allow user data to control event, retry or id fields, and if you must - sanitize the input before passing it to sse-channel, stripping any newlines.

Resources

https://github.com/rexxars/sse-channel/issues/42

Database specific

{
    "github_reviewed_at": "2026-05-05T22:17:02Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2026-05-12T20:16:42Z",
    "cwe_ids": [
        "CWE-93"
    ]
}

References

Affected packages

npm / sse-channel

Package

Name: sse-channel; View open source insights on deps.dev
Purl: pkg:npm/sse-channel

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.1

Database specific

last_known_affected_version_range

"<= 4.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-84hm-wfh8-c5pg/GHSA-84hm-wfh8-c5pg.json"