sse-channel is an SSE-implementation which can be used to any node.js http request/response stream.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 12, 2026 · NIST NVD

   Detected

   sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.

2. Jun 17, 2026 · NIST NVD

   Updated

   sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.

Sources

• CVE.orgVulnerability recordCVE-2026-44217

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-44217

  sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrar

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com