{"id":"GHSA-mh6f-8j2x-4483","aliases":[],"status":"published","title":"Critical severity vulnerability that affects event-stream and flatmap-stream","description":"The NPM package `flatmap-stream` is considered malicious.  A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`.  Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest  4.x version. \n\nUsers of `flatmap-stream` are encouraged to remove the dependency entirely.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-506"],"published":"2018-11-26T23:58:21Z","modified":"2023-01-12T05:08:40Z","fixes":[{"ecosystem":"npm","package":"event-stream","fixed_in":["4.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"event-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.6"},{"last_affected":"3.3.6"},{"fixed":"4.0.0"}]}],"versions":["3.3.6"]},{"source":"ghsa","ecosystem":"npm","package":"flatmap-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"npm","package":"event-stream","ranges":[{"type":"SEMVER","events":[{"introduced":"3.3.6"},{"fixed":"4.0.0"}]}],"versions":["3.3.6"]},{"source":"osv","ecosystem":"npm","package":"flatmap-stream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/dominictarr/event-stream/issues/116","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mh6f-8j2x-4483","tags":["advisory"]},{"url":"https://github.com/dominictarr/event-stream","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mh6f-8j2x-4483","title":"Critical severity vulnerability that affects event-stream and flatmap-stream","description":"The NPM package `flatmap-stream` is considered malicious.  A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`.  Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest  4.x version. \n\nUsers of `flatmap-stream` are encouraged to remove the dependency entirely.\n","status":"published","published":"2018-11-26T23:58:21Z","modified":"2023-01-12T05:08:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"osv":[{"id":"GHSA-mh6f-8j2x-4483","title":"Critical severity vulnerability that affects event-stream and flatmap-stream","description":"The NPM package `flatmap-stream` is considered malicious.  A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`.  Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest  4.x version. \n\nUsers of `flatmap-stream` are encouraged to remove the dependency entirely.\n","status":"published","published":"2018-11-26T23:58:21Z","modified":"2021-09-15T20:08:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}