Description

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T16:17:07.417Z",
  "pubdate": "2026-08-28T16:17:07.417Z",
  "executiveSummary": "A log forging vulnerability (CWE-117) exists in the morgan HTTP request logger middleware for Node.js due to insufficient sanitization of Unicode line separator characters.\nThe vulnerability allows an unauthenticated remote attacker to manipulate log entries by injecting specific Unicode characters, such as U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator).\nThese characters enable an attacker to inject arbitrary data into logs or break the log structure, causing downstream log management systems to parse a single request as multiple independent log records.\nThis behavior facilitates log forging, potentially allowing attackers to deceive security monitoring tools, bypass log-based auditing, or obscure malicious activity.\nThe issue is considered an incomplete fix follow-up to CVE-2026-5078, which addressed ASCII control characters but neglected Unicode line termination sequences.\nThe risk is categorized as high for environments relying on automated log analysis for security alerts or forensic investigations.\nThe vulnerability affects all versions of morgan prior to 1.12.0. Remediation requires upgrading the dependency to version 1.12.0 or later to ensure these Unicode characters are properly neutralized.",
  "technicalDetails": "The root cause of the vulnerability lies in the internal helper function responsible for escaping log token values within the morgan middleware. While previous versions were updated to neutralize ASCII-based control characters, the implementation failed to account for Unicode-compliant line terminators that are interpreted as line breaks by various text processing systems and log aggregators.\nThe affected versions include all releases of morgan prior to 1.12.0. The vulnerability is accessible to unauthenticated remote clients who can influence the content of log tokens.\nA common attack vector involves injecting these Unicode characters via HTTP request headers that morgan captures, such as the 'remote-user' token (often derived from Basic Authentication headers). By embedding U+0085, U+2028, or U+2029 within these fields, an attacker forces the logging system to interpret the malicious input as a line termination sequence.\nWhen a logging engine or a SIEM (Security Information and Event Management) system processes the resulting log file, it interprets these injected characters as end-of-line markers. Consequently, a single malicious HTTP request is split into multiple artificial log entries. An attacker can use this to craft 'fake' log entries that appear to originate from authorized users or to truncate real log lines, thereby falsifying the audit trail.\nThe exploitation process follows these steps: 1) The attacker crafts an HTTP request containing the target Unicode line separator characters within a user-controlled field (e.g., username). 2) The morgan middleware captures the request and includes the unescaped payload in the log output. 3) The log output is written to a file or sent to a stream. 4) Downstream log parsers and Unicode-aware processing software treat the injected characters as newlines, causing the log structure to split unexpectedly. 5) The resulting forged logs are indexed or presented to security operators, obscuring the true nature of the event or misattributing actions to other users.\nThis vulnerability is particularly impactful in automated environments where alerts are triggered based on pattern matching or specific log formats. By effectively injecting arbitrary text into a new log entry, an attacker can trigger false positives to overwhelm SOC teams or inject false negatives to hide subsequent malicious actions, effectively bypassing log-based intrusion detection systems."
}