CVE-2026-44214 eventsource-encoder: SSE event injection via unsanitized event and id fields
Attackers can inject arbitrary SSE fields or messages by controlling unsanitized event or id fields in the eventsource-encoder library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44214?
CVE-2026-44214 is a medium-severity vulnerability in rexxars eventsource-encoder, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
Which versions are affected by CVE-2026-44214?
2 open source packages ship an affected version, including eventsource-encoder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
eventsource-encoder npm | All versions | 1.0.2 |
eventsource-encoder npm | All versions | 1.0.2 |
Products include Rexxars Eventsource-Encoder.
How do I fix CVE-2026-44214?
Upgrade eventsource-encoder to 1.0.2 or later.
Is CVE-2026-44214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44214 exists.
Sources
Also known as GHSA-m9g3-3g99-mhpx.