Description (CNA)
eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This vulnerability is fixed in 1.0.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| rexxars / eventsource-encoder | affected < 1.0.2 |
CWE
CWE-93, CWE-113
References
ADP enrichment
No English description supplied.