CVE-2026-47890: Sse Incomplete Newline Escapecve-2026-47890-sse-incomplete-newline-escape
Server-Sent Events (SSE) data escaping only replaces LF ('\n') with the data field prefix, ignoring carriage return ('\r' / '\r\n') line breaks. This can lead to SSE frame corruption or injection if user input contains carriage return characters.
