{"id":"EUVD-2026-29794","enisaUuid":"ca772445-d653-3d43-98dc-382afc4a3ab0","description":"sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.","datePublished":"May 12, 2026, 7:51:06 PM","dateUpdated":"May 14, 2026, 7:52:02 PM","baseScore":6.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg\nhttps://github.com/rexxars/sse-channel/issues/42\n","aliases":"CVE-2026-44217\nGHSA-84hm-wfh8-c5pg\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"da9c5d8a-ec5a-3896-8ab8-c57271aac6cf","product":{"name":"sse-channel","vendor":{"name":"rexxars"}},"product_version":"\u003c 4.0.1"}],"enisaIdVendor":[{"id":"3836c987-8fb7-378d-bbcc-adf56b8bad13","vendor":{"name":"rexxars"}}],"enisaIdVulnerability":[{"id":"0cc501e4-f895-328c-912d-1ff00aa6af40","vulnerability":{"id":"CVE-2026-44217","description":"sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.","datePublished":"May 12, 2026, 7:51:06 PM","dateUpdated":"May 14, 2026, 7:52:02 PM","status":"PUBLISHED","baseScore":6.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg\nhttps://github.com/rexxars/sse-channel/issues/42\n","enisa_id":"EUVD-2026-29794\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"e11eba5f-f318-32ac-a83c-8903de63d0ab","product":{"name":"sse-channel","vendor":{"name":"rexxars"}},"product_version":"\u003c 4.0.1"}],"vulnerabilityVendor":[{"id":"87a72a7e-6552-3761-ad5b-2cfa3002c4c9","vendor":{"name":"rexxars"}}]}},{"id":"faed2fd3-0402-3265-a64b-07b78ad010c8","vulnerability":{"id":"GHSA-84hm-wfh8-c5pg","description":"sse-channel: SSE Injection via unsanitized event fields","datePublished":"May 5, 2026, 10:17:02 PM","dateUpdated":"May 13, 2026, 4:27:28 PM","baseScore":0.0,"references":"https://github.com/rexxars/sse-channel/security/advisories/GHSA-84hm-wfh8-c5pg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44217\nhttps://github.com/rexxars/sse-channel/issues/42\nhttps://github.com/rexxars/sse-channel\n","enisa_id":"EUVD-2026-29794\n","aliases":"CVE-2026-44217\nGHSA-84hm-wfh8-c5pg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}