Vulnerabilities in pkg:npm/eventsource-encoder

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m9g3-3g99-mhpx",
  "modified" : "2026-06-08T23:29:22Z",
  "published" : "2026-05-08T20:49:40Z",
  "aliases" : [ "CVE-2026-44214" ],
  "summary" : "eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields",
  "details" : "### Summary\n\n`eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (`\\n`, `\\r`, or `\\r\\n`) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to [GHSA-4hxc-9384-m385](https://github.com/advisories/GHSA-4hxc-9384-m385) (h3), but the vulnerable fields are `event`/`id` rather than `data`/`comment`. These are less likely to be user-controllable, but should still be sanitized.\n\n### Details\n\nIn `src/encode.ts`, `encodeMessage` interpolates `event` and `id` into the output without inspecting them for line terminators:\n\n```ts\nif (message.event) {\n  output += `event: ${message.event}\\n`\n}\n// ...\nif (typeof message.id === 'string' || typeof message.id === 'number') {\n  output += `id: ${message.id}\\n`\n}\n```\n\nThe SSE specification treats `\\r`, `\\n`, and `\\r\\n` as line terminators. A `\\n` (or `\\r`) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields.\n\nBy contrast, `data` and `comment` already normalize all three line-terminator forms via `NEWLINES_RE = /(\\r\\n|\\r|\\n)/g`, so they are not affected.\n\n### Proof of concept\n\n```js\nimport {encode} from 'eventsource-encoder'\n\n// Attacker-controlled value flows into `event`\nconst userSuppliedTopic = 'message\\nevent: admin\\ndata: {\"role\":\"admin\"}'\n\nconsole.log(encode({event: userSuppliedTopic, data: 'hello'}))\n```\n\nOutput:\n\n```\nevent: message\nevent: admin\ndata: {\"role\":\"admin\"}\ndata: hello\n\n```\n\nThe browser sees two events: a forged `admin` event with attacker-chosen payload, followed by the legitimate `message` event. The same primitive works through `id` for any string id value.\n\n### Impact\n\nIf untrusted input is passed into the `event` or `id` field of a message, an attacker can:\n\n- Spoof events of arbitrary type (rerouting payloads to handlers the attacker chooses)\n- Inject additional SSE fields (`data:`, `id:`, `retry:`) into the stream\n- Split a single `encode()` call into multiple distinct browser events\n- Override the client's `Last-Event-ID` via injected `id:` lines\n\nThe vulnerability requires that an application places attacker-controlled data into `event` or `id`. Applications that only put trusted, statically-defined values into these fields are not affected.\n\n### Patches\n\nFixed in `eventsource-encoder@1.0.2`. The `event` and string `id` fields are now validated; any value containing `\\r` or `\\n` causes the encoder to throw a `TypeError` rather than emit a malformed stream.\n\n### Workarounds\n\nIf users cannot upgrade, validate or strip line terminators from any untrusted value before passing it to `encode` / `encodeMessage`:\n\n```js\nfunction safeSingleLine(value) {\n  if (/[\\r\\n]/.test(value)) throw new Error('SSE field must be single-line')\n  return value\n}\n\nencode({event: safeSingleLine(topic), id: safeSingleLine(id), data})\n```\n\n### Resources\n\n- Related advisory (different package, same class): https://github.com/advisories/GHSA-4hxc-9384-m385\n- SSE spec, line terminators: https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream\n\n### Credit\n\nDiscovered while reviewing in light of GHSA-4hxc-9384-m385.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "eventsource-encoder"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44214"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rexxars/eventsource-encoder"
  }, {
    "type" : "WEB",
    "url" : "https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-113", "CWE-93" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-08T20:49:40Z",
    "nvd_published_at" : "2026-05-26T20:16:19Z"
  }
}