PT-2026-45901 · Npm · Morgan

Jon Church + 2 · CVE-2026-5078 · Published 2026-06-02 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions morgan versions 1.2.0 through 1.10.1

Description The logging middleware fails to neutralize control characters when the :remote-user token extracts the Basic auth username from the Authorization request header. An unauthenticated attacker can send a crafted Authorization Basic header containing Carriage Return (CR) or Line Feed (LF) bytes to inject forged log lines. This breaks the one-request-per-line structure of access logs, enabling log forgery against downstream log consumers. The issue affects the built-in combined, common, default, and short formats, as well as any custom format referencing :remote-user.

Recommendations Upgrade to version 1.11.0. As a temporary workaround, use a custom format string that does not include :remote-user.

Exploit

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2026-5078

GHSA-4VJ7-5MJ6-JM8M

Affected Products

Morgan

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5078.json · Exploit
• https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5078 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5078 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5078 · Security Note
• https://osv.dev/vulnerability/GHSA-4vj7-5mj6-jm8m · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5078 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5078 · Vendor Advisory
• https://github.com/expressjs/morgan · Note
• https://twitter.com/kom_256/status/2061897432233824347 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2062092579257094395 · Twitter Post
• https://t.me/CVEtracker/55692 · Telegram Post
• https://t.me/cveNotify/165776 · Telegram Post
• https://cna.openjsf.org/security-advisories.html · Note