critical
CVE-2022-1650
eventsource: Exposure of Sensitive Information
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
GHSA9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Red Hat9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (high), Ubuntu (medium).
Description
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | eventsource | 1.1.1, 2.0.2 |
| debian 10 | node-eventsource | 0.2.1-1+deb10u1 |
| debian 11 | node-eventsource | 1.0.7-1+deb11u1 |
| debian 12 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 13 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 14 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 9 | node-eventsource | no fix listed |
| echo | node-eventsource | 2.0.2+~1.1.8-1 |
| rapidfort Oracle Linux 9 | dotnet-host | 6.0.7-1.0.1.el9_0 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.107-1.el9_0 |
| rapidfort ubuntu 20.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
Show all 29 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | eventsource | 1.1.1, 2.0.2 |
| debian 10 | node-eventsource | 0.2.1-1+deb10u1 |
| debian 11 | node-eventsource | 1.0.7-1+deb11u1 |
| debian 12 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 13 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 14 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 9 | node-eventsource | no fix listed |
| echo | node-eventsource | 2.0.2+~1.1.8-1 |
| rapidfort Oracle Linux 9 | dotnet-host | 6.0.7-1.0.1.el9_0 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.107-1.el9_0 |
| rapidfort ubuntu 20.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| Red Hat | servicemesh-grafana | no fix listed |
| Red Hat | servicemesh-prometheus | no fix listed |
| rocky 8 | aspnetcore-runtime-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | aspnetcore-targeting-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-apphost-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-hostfxr-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-runtime-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-sdk-3.1 | 3.1.422-1.el8_6 |
| rocky 8 | dotnet-targeting-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-templates-3.1 | 3.1.422-1.el8_6 |
| ubuntu 16.04-ESM | node-eventsource | 0.1.6-1ubuntu0.1~esm1 |
| ubuntu 18.04 | node-eventsource | 0.2.1-1+deb10u1build0.18.04.1 |
| ubuntu 18.04-ESM | node-eventsource | 0.2.1-1+deb10u1build0.18.04.1 |
| ubuntu 20.04 | node-eventsource | 0.2.1-1+deb10u1build0.20.04.1 |
| ubuntu 20.04-ESM | node-eventsource | 0.2.1-1+deb10u1build0.20.04.1 |
| ubuntu 22.04 | node-eventsource | 1.1.0+~1.1.8-1ubuntu0.1 |
References
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1650.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34716.json
- https://access.redhat.com/security/cve/CVE-2022-1650
- https://github.com/EventSource/eventsource/commit/f9f6416567bff62c1af2f4314be51d9870e94bc2
- https://github.com/EventSource/eventsource/pull/273#issuecomment-1127624508
- https://github.com/eventsource/eventsource
- https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4
- https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4%20%28v2.0.2%29
All 14 references
- https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e
- https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e/
- https://lists.debian.org/debian-lts-announce/2022/12/msg00021.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1650
- https://ubuntu.com/security/notices/USN-6082-1
- https://www.cve.org/CVERecord?id=CVE-2022-1650