{"id":"GHSA-4vj7-5mj6-jm8m","revision":null,"records":[{"revision":"ee87434c4d224a7da4e0dca046fb92dc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-5078","aliases":[],"title":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user","description":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.","state":0,"publishedAt":"2026-06-03T05:56:49.512+00:00","modifiedAt":"2026-06-03T13:19:32.922+00:00","affected":[{"ecosystem":"Vendor product","name":"morgan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"morgan\",\n                    \"product\": \"morgan\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.2.0\",\n                            \"lessThanOrEqual\": \"1.10.1\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"1.11.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/morgan\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5078","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-5078","identifiers":["CVE-2026-5078"]},"retained":false,"historicalAffected":[]},{"revision":"a4623a7dbb7849119f5cf56fd999b0c7","observedAt":"2026-11-14T00:10:56.7+00:00","statement":{"source":"euvd","id":"EUVD-2026-34067","aliases":["CVE-2026-5078","GHSA-4vj7-5mj6-jm8m"],"title":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send …","description":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":null}],"references":["https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34067","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 3, 2026, 5:56:49 AM","dateUpdated":"Jun 3, 2026, 1:19:32 PM"},"relatedAdvisories":[{"id":"RHSA-2026:38236","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-5078","CVE-2026-6733","CVE-2026-6734","CVE-2026-9678","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12151","CVE-2026-53550","CVE-2026-59869"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-34067","identifiers":["EUVD-2026-34067","CVE-2026-5078","GHSA-4vj7-5mj6-jm8m"]},"retained":false,"historicalAffected":[]},{"revision":"75f05d4d5b834770a2fb3ca1cdd704f9","observedAt":"2026-10-25T13:17:10.707+00:00","statement":{"source":"nvd","id":"CVE-2026-5078","aliases":[],"title":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send …","description":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.","state":0,"publishedAt":"2026-06-03T08:16:19.743+00:00","modifiedAt":"2026-07-22T19:10:00.12+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5078","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-117"],"productCriteria":["cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-06-03T08:16:19.743","lastModified":"2026-07-22T19:10:00.120"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-5078","identifiers":["CVE-2026-5078"]},"retained":false,"historicalAffected":[]},{"revision":"cc716bf2930749f78f9dd77552be42e2","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-4vj7-5mj6-jm8m","aliases":["CVE-2026-5078"],"title":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user","description":"### Impact\n\nMorgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs.\n\nThe built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`.\n\n### Patches\n\nUsers should upgrade to version 1.11.0.\n\n### Workarounds\n\nUse a custom format string that does not include `:remote-user`.","state":0,"publishedAt":"2026-07-10T14:32:15+00:00","modifiedAt":"2026-09-10T03:51:10.3384356+00:00","affected":[{"ecosystem":"npm","name":"morgan","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0"},{"kind":"fixed","version":"1.11.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m","https://nvd.nist.gov/vuln/detail/CVE-2026-5078","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan"],"sourceUrl":"https://github.com/advisories/GHSA-4vj7-5mj6-jm8m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4vj7-5mj6-jm8m","identifiers":["GHSA-4vj7-5mj6-jm8m","CVE-2026-5078"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5204338+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5204347+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-576973bd2a8c36ed3d013750ca82fcede7b10fe95f071dbe9a6a4dd94759ab84","complete":true,"records":425782,"lastAttemptAt":"2026-11-15T07:30:53.2515651+00:00","lastSuccessAt":"2026-11-15T07:30:53.2350398+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.2515651+00:00","snapshotPublishedAt":"2026-11-15T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5e7f928ed09c4936b5ecee65ceceefde","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T07:38:12.9554625+00:00","lastSuccessAt":"2026-11-15T07:38:13.0927522+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:38:13.0927522+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5213705+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5213739+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35abf047bdfe46089a52c4c139c37942","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T07:31:01.665293+00:00","lastSuccessAt":"2026-11-15T05:33:23.837+00:00","error":"12 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T05:33:23.837+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13862,"expectedIdentifiers":13874,"failedIdentifiers":12},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T07:30:53.9403022+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.9403022+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T07:30:53.3921516+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.3921516+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T07:30:54.2664324+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.2664324+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-878f718ccd076f540460423958c8e379b139b997b45858275573ecc4d702fe9a","complete":true,"records":232474,"lastAttemptAt":"2026-11-15T07:30:53.7776854+00:00","lastSuccessAt":"2026-11-15T05:33:06.8241102+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.7776854+00:00","snapshotPublishedAt":"2026-11-15T04:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}