CVE-2026-109924

The undici HTTP client library for Node.js (versions 6.5.0-6.29.0 , 7.0.0-7.30.0 , and 8.0.0-8.12.1 ) contains a vulnerability in its EventSource client. A malicious or compromised Server-Sent Events (SSE) peer can trigger a Denial of Service (DoS) by exhausting process memory. The root cause is ...

CVE-2026-109924

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

PT-2026-115101

Name of the Vulnerable Software and Affected Versions undici versions 6.5.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The EventSource client in this Node.js HTTP client library can be forced to exhaust process memory by a malicious...

CVE-2026-109924: Allocation of Resources Without Limits or Throttling

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

ROOT-APP-NPM-CVE-2022-1650 CVE-2022-1650 in eventsource - Patched by Root

Root has patched CVE-2022-1650 in the eventsource package for Root:npm. Multiple fixed versions available...

Malicious code in @divineubg/divine (npm)

Source: amazon-inspector 52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be index.js exports a listenclientId function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-/sse via EventSource and, on receiving messages with action 'EVALCODE', passes the message payload to eval an...

CLSA-2026-1781139205 TuxCare security update for eventsource (1 CVE)

TuxCare rebuilt eventsource to address 1 CVE. Fixed in 1.1.0-tuxcare.1...

CLSA-2026-1776818200 TuxCare security update for eventsource (1 CVE)

TuxCare rebuilt eventsource to address 1 CVE. Fixed in 0.1.6-tuxcare.1...

PT-2026-75023

TuxCare rebuilt eventsource to address 1 CVE. Fixed in 1.1.0-tuxcare.1...

PT-2026-74522

TuxCare rebuilt eventsource to address 1 CVE. Fixed in 0.1.6-tuxcare.1...

CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

EUVD-2026-31968

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-44214 eventsource-encoder: SSE event injection via unsanitized event and id fields

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-44214

CVE-2026-44214 concerns eventsource-encoder where unsanitized event and id fields can inject SSE line terminators, enabling forged SSE fields/messages. Affects versions prior to 1.0.2; patch released in 1.0.2 that validates/escapes those fields. Public advisories (GHSA, OSV, CVS) describe the imp...

CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-46431

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient ...

EUVD-2026-31870

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient ...

CVE-2026-44214: Improper Neutralization of CRLF Sequences

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-46431: Permissive Cross-domain Policy with Untrusted Domains

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient ...