morgan vulnerable to Log Forging via unescaped Unicode line separators
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| morgan | morgan | before 1.12.0 | 1.12.0 | Patch available | CNA |
| — | morgan (npm) | before 1.12.0 | 1.12.0 | Patch available | GHSA-jxfw-x594-9x9m |
- morgan Vendormorgan Affected before 1.12.0 Fixed in 1.12.0 Patch available CNA
- morgan (npm) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-jxfw-x594-9x9m
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:* | before 1.12.0 | Vulnerable | Morgan Project |
- cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:* Versions before 1.12.0 Vulnerable ·Morgan Project
Remediation
- Fix · CNA morgan (morgan) Fixed in 1.12.0
- Fix · GHSA-jxfw-x594-9x9m morgan (npm) Fixed in 1.12.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15603
- 2026-10-03 Alias added: GHSA-jxfw-x594-9x9m
References
Advisory 3
More morgan vulnerabilities
- TI-2026-59956 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-15603 · CVE Program
- CVE-2026-15603 · NVD
- FIRST EPSS
- GHSA-jxfw-x594-9x9m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-15603 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences