server-sent events

CVE-2026-43968 is a medium-severity CRLF injection flaw disclosed in May 2026 in ninenines cowlib, where the Erlang library’s Server-Sent Events encoder can let attacker-controlled carriage returns split one intended event into additional forged events for downstream SSE clients. The bug is not...