Morgan
Monthly
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Log injection in morgan Node.js middleware versions 1.2.0 through 1.10.1 allows unauthenticated remote attackers to forge access log entries by embedding CR or LF control characters in the Basic authentication username of the Authorization request header. The :remote-user format token writes this value to the log stream without sanitization, breaking the one-request-per-line log structure and enabling attackers to fabricate arbitrary log lines visible to downstream consumers such as SIEMs or log aggregators. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, but the zero-prerequisite network attack vector and widespread use of morgan across the Node.js/Express ecosystem make this a meaningful integrity risk for security monitoring pipelines.
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Log injection in morgan Node.js middleware versions 1.2.0 through 1.10.1 allows unauthenticated remote attackers to forge access log entries by embedding CR or LF control characters in the Basic authentication username of the Authorization request header. The :remote-user format token writes this value to the log stream without sanitization, breaking the one-request-per-line log structure and enabling attackers to fabricate arbitrary log lines visible to downstream consumers such as SIEMs or log aggregators. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, but the zero-prerequisite network attack vector and widespread use of morgan across the Node.js/Express ecosystem make this a meaningful integrity risk for security monitoring pipelines.
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.