GHSA-4vj7-5mj6-jm8m
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
At a glance
- Published
- Updated
- CVE
- CVE-2026-5078
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs. The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`. ### Patches Users should upgrade to version 1.11.0. ### Workarounds Use a custom format string that does not include `:remote-user`.
Affected packages
| Package | Versions |
|---|---|
| npm · morgan | introduced 1.2.0, fixed 1.11.0 |
References
- https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-5078 ADVISORY
- https://cna.openjsf.org/security-advisories.html WEB
- https://github.com/expressjs/morgan PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |