CVE-2026-5078

MediumCVSS 5.3

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.

Risk Assessment

An attacker can forge access log entries, hindering incident analysis and potentially leading to incorrect conclusions during security audits.

Recommendation

Upgrade Morgan to version 1.11.0 or later. If upgrading is not possible, remove the :remote-user token from the log format.

Other vulnerabilities in Morgan

CVE-2026-15603Medium
Morgan, an HTTP request logger middleware for Node.js, in versions prior to 1.12.0 did not neutralize the Unicode line separator characters U+0085, U+2028, and U+2029 in log token values. An unauthenticated remote client can place these characters in an attacker-controlled log token, such as a Basic auth username, causing downstream log processing to split a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078. The issue is fixed in morgan 1.12.0.

Original NVD description (English source)

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.