CVE-2026-15603

MediumCVSS 5.3

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Morgan, an HTTP request logger middleware for Node.js, in versions prior to 1.12.0 did not neutralize the Unicode line separator characters U+0085, U+2028, and U+2029 in log token values. An unauthenticated remote client can place these characters in an attacker-controlled log token, such as a Basic auth username, causing downstream log processing to split a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078. The issue is fixed in morgan 1.12.0.

Risk Assessment

An attacker can forge log entries, which can hinder security auditing, hide attacks, or mislead monitoring systems.

Recommendation

Upgrade morgan to version 1.12.0 or later, which extends the escaping set to cover these Unicode line separators.

Other vulnerabilities in morgan

CVE-2026-5078Medium
Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.

Original NVD description (English source)

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.