CVE-2026-15603
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Morgan, an HTTP request logger middleware for Node.js, in versions prior to 1.12.0 did not neutralize the Unicode line separator characters U+0085, U+2028, and U+2029 in log token values. An unauthenticated remote client can place these characters in an attacker-controlled log token, such as a Basic auth username, causing downstream log processing to split a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078. The issue is fixed in morgan 1.12.0.
Risk Assessment
An attacker can forge log entries, which can hinder security auditing, hide attacks, or mislead monitoring systems.
Recommendation
Upgrade morgan to version 1.12.0 or later, which extends the escaping set to cover these Unicode line separators.
Other vulnerabilities in morgan
See all- CVE-2019-5413Critical
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
- CVE-2026-87859Medium
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field.
- CVE-2026-5078Medium
Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.
Original NVD description (English source)
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS