sse-channel: SSE Injection via unsanitized event fields

Description

Implementations that allows user-provided values to be passed to event, retry or id fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream.

Recommendation

Update the sse-channel package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.0.1

References

• GHSA-84hm-wfh8-c5pg
• CVE-2026-44217
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API - CVE-2026-45719
• Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
• i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

sse-channel