CVE-2026-5078 Details
Description
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
A log forging vulnerability has been identified in the Morgan logging middleware, specifically in versions 1.2.0 through 1.10.1. The issue arises because the ':remote-user' token extracts the Basic authentication username from the Authorization header and logs it without neutralizing control characters. This flaw allows an unauthenticated attacker to send a crafted Authorization header containing CR or LF bytes, injecting forged log lines that disrupt the standard one-request-per-line format of access logs. The vulnerability affects the built-in 'combined', 'common', 'default', and 'short' log formats, as well as any custom format that includes ':remote-user'.
Users are advised to upgrade to Morgan version 1.11.0 or later, which addresses the vulnerability by neutralizing control characters in the ':remote-user' token output. Alternatively, a custom format string that excludes ':remote-user' can be used.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Third Party Advisory |
| https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-117 | Improper Output Neutralization for Logs | openjs |
Affected Products
| Product | Versions |
|---|---|
| morgan project morgan | >= 1.2.0, < 1.11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | Initial Analysis | [email protected] |
| Jun 3, 2026 | New CVE Received | openjs |