Executive brief
sse-channel is a Node.js library used to manage Server-Sent Events (SSE), which allow servers to push real-time updates to web browsers. A security flaw allows attackers to inject fake messages into these data streams if the application uses untrusted user input for certain message fields. This could lead to users seeing fraudulent information or the web application performing unintended actions based on the spoofed data.
Technical details
The sse-channel library prior to version 4.0.1 is vulnerable to CRLF injection (CWE-93) within its message formatting logic. The parseMessage() function fails to sanitize newline characters (\n, \r) when concatenating user-provided values into the 'event', 'id', and 'retry' fields of the SSE wire format. An attacker who can control these fields can inject additional SSE fields or entirely new events into the stream. This allows for event spoofing and client-side manipulation of EventSource listeners. The vulnerability is fixed in version 4.0.1 by stripping newline characters from these fields.
Affected products
- rexxars sse-channel <= 4.0.0
Timeline
- 2026-04-26: disclosed: Issue reported on GitHub by Kai Aizen
- 2026-04-27: advisory: GitHub security advisory GHSA-84hm-wfh8-c5pg published
- 2026-04-27: patched: Version 4.0.1 released to address the vulnerability
- 2026-05-12: other: CVE-2026-44217 assigned