CVE-2026-44214: Rexxars Eventsource-encoder SSRF Flaw

CVE-2026-44214 Overview

CVE-2026-44214 is a CRLF injection vulnerability [CWE-93] in rexxars/eventsource-encoder, a Node.js library that encodes events as well-formed EventSource/Server-Sent Event (SSE) messages. Versions prior to 1.0.2 fail to sanitize the event and id fields of an EventSourceMessage before serializing them onto the wire. An attacker who controls either field can inject SSE line terminators (\n, \r, or \r\n) and forge additional SSE fields or entire downstream messages. The issue is fixed in version 1.0.2.

Critical Impact
Attacker-controlled input in the event or id fields can forge arbitrary Server-Sent Events on the stream, enabling client-side message spoofing against SSE consumers.

Affected Products

rexxars/eventsource-encoder versions prior to 1.0.2
Node.js applications consuming this package for SSE encoding
Downstream SSE clients receiving forged messages from a vulnerable encoder

Discovery Timeline

2026-05-26 - CVE-2026-44214 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-44214

Vulnerability Analysis

The Server-Sent Events protocol uses newline characters as field and message delimiters. Each field is encoded as field: value\n, and a blank line (\n\n) terminates a message. The eventsource-encoder library serializes an EventSourceMessage object containing fields such as event, id, and data into this newline-delimited format.

Prior to 1.0.2, the encoder writes the event and id field values directly into the output stream without stripping or rejecting embedded newline characters. When an attacker controls these values, for example through a user-supplied identifier passed into id, they can embed \n, \r, or \r\n sequences. The injected terminators are interpreted by the SSE parser on the receiving end as legitimate field or message boundaries.

The practical effect is message forgery on the SSE stream. An attacker can append synthetic data: fields, change the event type seen by the client, or terminate the current message and inject an entirely new one. Clients consuming the stream cannot distinguish forged messages from legitimate server output.

Root Cause

The library treats event and id field values as opaque strings and concatenates them directly into the SSE wire format without validating that they conform to the single-line constraint defined by the EventSource specification. This is a classic CRLF injection pattern mapped to the SSE protocol.

Attack Vector

Exploitation requires the application to pass attacker-influenced data into the event or id fields of an EventSourceMessage. No authentication or user interaction is required at the protocol level. The attack is network-reachable wherever the resulting SSE stream is delivered to clients. Refer to the GitHub Security Advisory GHSA-m9g3-3g99-mhpx for the authoritative technical description.

Detection Methods for CVE-2026-44214

Indicators of Compromise

SSE responses containing unexpected event: or data: fields that do not match the application's defined event schema.
Application logs showing event or id field values containing raw \n, \r, or %0A/%0D sequences before serialization.
Anomalous duplication of SSE message boundaries (\n\n) within a single logical message.

Detection Strategies

Audit dependency manifests (package.json, package-lock.json, yarn.lock) for eventsource-encoder at versions below 1.0.2.
Add server-side validation that rejects any event or id value containing CR or LF characters before it reaches the encoder.
Perform fuzz testing of SSE endpoints with payloads embedding \r\n sequences to confirm whether forged messages reach clients.

Monitoring Recommendations

Log the pre-serialization values of event and id fields and alert on control characters.
Monitor SSE clients for parsing errors or unexpected event types that may indicate forged messages on the stream.
Track Software Composition Analysis (SCA) output for newly introduced vulnerable versions in CI/CD pipelines.

How to Mitigate CVE-2026-44214

Immediate Actions Required

Upgrade eventsource-encoder to version 1.0.2 or later across all Node.js services.
Identify every code path that passes untrusted input into the event or id fields of an EventSourceMessage.
Add input validation at the application boundary to strip or reject CR and LF characters in those fields.

Patch Information

The maintainer fixed this issue in eventsource-encoder version 1.0.2. Details are published in the GitHub Security Advisory GHSA-m9g3-3g99-mhpx. Update via npm install eventsource-encoder@^1.0.2 or the equivalent command for your package manager.

Workarounds

If upgrading is not immediately possible, wrap calls to the encoder with a sanitizer that removes \r and \n from event and id values.
Restrict the id field to a known-safe character set such as alphanumerics and hyphens.
Treat event names as a server-controlled enum and reject any value not in an allow-list.

bash

# Update the package to the fixed release
npm install eventsource-encoder@^1.0.2

# Verify the resolved version
npm ls eventsource-encoder