{"action":"Upgrade eventsource-encoder to 1.0.2 or later.","affected":[{"fixed":"1.0.2","introduced":"0"}],"component":"eventsource-encoder","cve_ids":["CVE-2026-44214"],"ecosystem":"npm","epss":0.00277,"exploited":false,"fixed_versions":["1.0.2"],"ghsa_id":"GHSA-m9g3-3g99-mhpx","id":"tcs_01M5KG0C9NEXSEJMDAMQ9GMSRS","modified_at":"2026-06-08T23:45:16.047996564Z","published_at":"2026-05-08T20:49:40Z","references":["https://osv.dev/vulnerability/GHSA-m9g3-3g99-mhpx","https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx","https://nvd.nist.gov/vuln/detail/CVE-2026-44214","https://github.com/rexxars/eventsource-encoder","https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-m9g3-3g99-mhpx","url":"https://osv.dev/vulnerability/GHSA-m9g3-3g99-mhpx"}],"summary":"eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields"}