Trusted handlers
Register only code you intend to execute in the publisher's process and privilege context. A subscriber can mutate referenced payloads or throw.
Security
Keep the trust boundary explicit.
event-pubsub dispatches application functions synchronously. It does not sandbox subscribers, serialize payloads, authorize event names, catch synchronous throws, or observe returned promises.
Bounded lifecycle
Use off and reset when components are retired. Long-lived hubs retain registered functions and their captured state.
Safe names
Prototype-like strings such as __proto__, constructor, and toString are stored safely and regression-tested.
| Version line | Status | Action |
|---|---|---|
| 6.1.1 on npm and GitHub | Current supported release | Install on Node.js 22.12 or newer. |
| 6.0.0 through 6.1.0 | Superseded 6.x releases | Upgrade to the current 6.x release. |
| 5.x and older | Security fixes not planned | Upgrade to the latest 6.x release. |
Report privately.
Do not open a public issue for a suspected vulnerability. Use the repository's private GitHub Security Advisory form with a minimal reproduction, impact, and affected versions.