The vulnerability in sse-channel allows an attacker to inject arbitrary messages into an SSE stream by sending unsanitized values for the event, retry, or id fields. This can result in spoofed events that appear legitimate to clients, potentially leading to confusion, traffic hijacking, or the execution of unintended actions. The weakness is a form of SSE injection (CWE‑93) and is present in all releases before 4.0.1.

The affected product is the sse-channel library from rexxars, used in any node.js application that streams SSE responses via an http request/response. All versions prior to 4.0.1 are vulnerable; upgrading to 4.0.1 or later resolves the issue.

The CVSS score of 6.6 indicates moderate risk, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by crafting HTTP requests containing arbitrary values for the event, retry, or id fields; the lack of input sanitization permits message injection. If the SSE endpoint is publicly accessible, the exploit can be performed remotely, making it a significant threat to applications that rely on trust in the streamed events.