Skip to content
OpenAdvisories

Package · npm

eventsource-encoder

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.8
    CVE-2026-44214

    eventsource-encoder: SSE event injection via unsanitized event and id fields

    eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either fiel…

    rexxars eventsource-encoder eventsource-encoder npm