CRLF Injection Vulnerability in Cowlib by Ninenines

CVE-2026-43968

What is CVE-2026-43968?

The Cowlib library by Ninenines contains a vulnerability that allows attackers to exploit improper neutralization of CRLF sequences, leading to potential event splitting and injection vulnerabilities. The specific issue lies in the handling of unvalidated field values in the Server-Sent Events (SSE) implementation, which does not adequately sanitize carriage return characters. This enables an attacker to craft arbitrary event types and data payloads that can adversely impact client-side logic and potentially facilitate stored-XSS-like behaviors when the injected data is rendered in the DOM. This vulnerability specifically affects Cowlib version 2.6.0.

References