TI-2026-13127 CVE-2026-15603 · GHSA-jxfw-x594-9x9m
morgan vulnerable to Log Forging via unescaped Unicode line separators
Priority LOW 30
morgan is an HTTP request logger middleware for Node.js.
Vulnerabilities
3 records
TI-2026-04433 CVE-2026-5078 · GHSA-4vj7-5mj6-jm8m
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Priority LOW 30
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters.
TI-2019-03823 CVE-2019-5413 · GHSA-gwg9-rgvj-4h5j
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Priority MEDIUM 55
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.