The vulnerability allows an attacker with control over the event or id fields of an EventSourceMessage to insert line terminators that terminate the current field and begin new SSE fields. By injecting , , or \n characters, the attacker can forge additional fields or entire messages on the stream, which may lead to unintended client behavior or content injection.

Packages from the rexxars organization that implement the eventsource‑encoder library, specifically all releases prior to version 1.0.2, are affected. The vulnerability is fixed in 1.0.2 and later releases.

The CVSS score of 5.8 signifies a medium severity vulnerability. No EPSS score is available and the CVE is not listed in CISA’s KEV catalogue, indicating no confirmed exploitation activity at the time of this analysis. The likely attack vector is local to the component that serializes SSE messages; an adversary must be able to supply the event or id fields to the library, which typically requires code execution or a flaw in the application using the library.