Skip to content
OpenAdvisories

Vendor

rexxars

2 known vulnerabilities.

Products

eventsource-encoder 1 sse-channel 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.8
    CVE-2026-44214

    eventsource-encoder: SSE event injection via unsanitized event and id fields

    eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either fiel…

    rexxars eventsource-encoder eventsource-encoder npm
  • Medium 6.6
    CVE-2026-44217

    sse-channel: SSE Injection via unsanitized event fields

    sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker …

    rexxars sse-channel sse-channel npm