We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-44217

CVE-2026-44217

Node.js

Severity: —
CVSS: —CVSS
Published: 2026-05-12
Last modified: 2026-05-12
CWE: CWE-93

Description

sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.

References

https://github.com/rexxars/sse-channel/issues/42
https://github.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg

Summary

Description

References