CVE-2022-1650

What it actually does

The flaw is an information-disclosure weakness in eventsource/eventsource before v2.0.2 where sensitive request information can be retained and forwarded when it should be stripped before transfer. In practical terms, applications using the vulnerable EventSource client may leak authentication material, such as Authorization headers, cookies, or other custom headers, during network interactions such as redirects to a different origin. Because leaked credentials can be reused by an attacker, the impact can extend beyond confidentiality to unauthorized actions against APIs or services reachable with those credentials. The CVSS vector indicates network exploitation with low attack complexity and no attacker authentication required, but user or application interaction is needed to initiate the vulnerable request flow.

Why it matters to the business

If vulnerable versions are present in applications or packaged software, secrets used by those applications may be exposed to an attacker-controlled service. This can lead to account takeover, unauthorized API access, data exposure, and downstream compromise of services that trust the leaked credential. The vulnerability is older and is not listed in CISA KEV, and the current EPSS score is low, but public exploit knowledge is available, so internet-facing or token-bearing EventSource usage should still be treated as a meaningful risk. Organizations with Ubuntu systems using the listed NVIDIA driver packages should also ensure they are at the fixed distribution versions where applicable.

How an attack unfolds

An attacker first identifies or influences an application path that causes a vulnerable EventSource client to connect to a URL while carrying sensitive headers or cookies. The attacker then causes that request to encounter an attacker-controlled redirect or endpoint. Because the vulnerable client does not properly remove sensitive information before the subsequent transfer, the redirected request can include credentials that should have been scoped only to the original destination. The attacker collects the leaked header or cookie from server logs, then attempts to reuse it against the legitimate service. If the credential has broad privileges or long lifetime, the attacker may read protected data, modify resources, or pivot to additional services.

How to fix it

Upgrade eventsource/eventsource to v2.0.2 or later. For source-based use, ensure the repository includes commit 774ed1024c6a151eab730800ccb61a42bb070b23 or a later release containing that fix. For Ubuntu packages listed as affected, update to the fixed distribution builds: nvidia-graphics-drivers-390 on Ubuntu 18.04 LTS to 390.154-0ubuntu0.18.04.1 or later; nvidia-graphics-drivers-390 on Ubuntu 20.04 LTS to 390.154-0ubuntu0.20.04.1 or later; and nvidia-graphics-drivers-450-server on Ubuntu 18.04 LTS to 450.203.03-0ubuntu0.18.04.1 or later. As defense in depth, avoid sending long-lived secrets in EventSource requests, use short-lived scoped tokens, restrict redirects to trusted origins, disable following untrusted redirects where possible, and rotate any credentials that may have been exposed through vulnerable request flows.

How to confirm the fix worked

Confirm dependency versions using package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls eventsource, or software composition analysis tooling, and verify no deployed application resolves eventsource below v2.0.2. For source builds, confirm the fixed commit 774ed1024c6a151eab730800ccb61a42bb070b23 or later is present. On Ubuntu systems, validate installed package versions with dpkg -l or apt-cache policy and ensure the NVIDIA driver packages meet or exceed the fixed versions. Functionally test by creating an EventSource request with a test Authorization header to a controlled endpoint that redirects to a different origin; after remediation, sensitive headers should not be forwarded to the redirected origin. Also verify application configuration does not allow attacker-controlled SSE URLs or unrestricted cross-origin redirects.

Typical attack path

1. Identify an application or component that uses eventsource/eventsource before v2.0.2 and sends credentials or custom headers with EventSource requests.
2. Find a way to influence the EventSource URL, redirect target, or upstream SSE endpoint used by the application.
3. Return an HTTP redirect or otherwise cause the vulnerable client to make a follow-on request to an attacker-controlled origin.
4. Capture leaked sensitive headers, cookies, bearer tokens, or API keys in attacker-controlled web server logs.
5. Replay the captured credential against the legitimate API or service.
6. Use the credential’s permissions to access data, modify resources, or expand access.

How to detect it

Review web proxy, egress gateway, application, and upstream web server logs for EventSource/SSE traffic that followed HTTP 301, 302, 303, 307, or 308 redirects to a different host while carrying Authorization, Cookie, X-API-Key, or similar sensitive headers. Focus on requests with Accept: text/event-stream, Cache-Control: no-cache, or Last-Event-ID headers sent from application servers or backend workloads to unusual external domains. Inspect attacker-controlled or unexpected destination logs, if available, for bearer tokens, session cookies, API keys, or custom authentication headers. In application logs, look for SSE connection errors, unexpected redirect responses, or URL parameters indicating external callback or stream endpoints. For forensic review, correlate the first suspicious outbound SSE request with subsequent use of the same credential from unfamiliar IP addresses, user agents, geographies, or autonomous systems. Also search dependency inventories and build artifacts for eventsource versions below v2.0.2 to identify systems where historical logs should be reviewed more closely.

• eventsource@1.
• eventsource@0.
• "eventsource": "<2.0.2"
• "eventsource":"<2.0.2"
• Accept: text/event-stream
• Last-Event-ID
• Cache-Control: no-cache
• Authorization: Bearer
• X-API-Key:
• HTTP/1.1 301
• HTTP/1.1 302
• HTTP/1.1 307
• HTTP/1.1 308
• Location: http://
• Location: https://

What your security team should do

• Prioritize upgrading all applications that use eventsource/eventsource below v2.0.2, especially services that attach Authorization headers, cookies, API keys, or other secrets to EventSource requests.
• Search dependency manifests and SBOMs for vulnerable eventsource versions and create remediation tickets for any direct or transitive usage.
• Patch affected Ubuntu NVIDIA driver packages to the fixed distribution versions where those packages are in use.
• Review application code for EventSource calls that accept user-controlled URLs or follow redirects to arbitrary origins.
• Rotate credentials that may have been sent by vulnerable EventSource clients to untrusted or externally controlled endpoints.
• Add egress monitoring for EventSource traffic carrying sensitive headers to unexpected domains or immediately following HTTP redirects.
• Prefer short-lived, audience-restricted tokens for SSE connections and enforce server-side origin and redirect allowlists.