CVE-2026-15603morgan vulnerable to Log Forging via unescaped Unicode line separators
Updated under an hour ago ()
Does this affect you?
It affects morgan and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-117
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Analyzed
- Record last updated
- Aug 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
morgan morgan morgan:morgan (from the name) | before 1.12.0 | CNA record |
morgan_project morgan morgan_project:morgan | before 1.12.0 | NVD |
References
- https://github.com/expressjs/morgan/security/advisories/GHSA-jxfw-x594-9x9mvendor-advisory
- https://cna.openjsf.org/security-advisories.htmlthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.