The eventsource-encoder library encodes events as Server-Sent Events (SSE) messages. Versions before 1.0.2 fail to neutralize CRLF sequences in the event or id fields of EventSourceMessage objects. This improper neutralization (CWE-93) allows an attacker who controls these fields to inject line terminators (\n, \r, or \r\n), enabling them to forge additional SSE fields or entire messages within the stream. This can potentially manipulate the SSE stream's integrity. The vulnerability is addressed in version 1.0.2.

An attacker able to control the event or id fields can inject arbitrary CRLF sequences into SSE messages, potentially forging additional fields or messages. This impacts the integrity of the SSE stream but does not affect confidentiality or availability. The CVSS score of 5.8 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

This vulnerability is fixed in eventsource-encoder version 1.0.2. Users should upgrade to version 1.0.2 or later to remediate this issue. Patch status is not explicitly confirmed in the provided data, so users should verify the availability of the fix and any additional guidance in the vendor advisory or official project repository before deployment.