CVE-2026-5078
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.
Risk Assessment
An attacker can forge access log entries, hindering incident analysis and potentially leading to incorrect conclusions during security audits.
Recommendation
Upgrade Morgan to version 1.11.0 or later. If upgrading is not possible, remove the :remote-user token from the log format.
Other vulnerabilities in Morgan
See all- CVE-2019-5413Critical
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
- CVE-2026-87859Medium
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field.
- CVE-2026-15603Medium
Morgan, an HTTP request logger middleware for Node.js, in versions prior to 1.12.0 did not neutralize the Unicode line separator characters U+0085, U+2028, and U+2029 in log token values. An unauthenticated remote client can place these characters in an attacker-controlled log token, such as a Basic auth username, causing downstream log processing to split a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078. The issue is fixed in morgan 1.12.0.
Original NVD description (English source)
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS