{"id":"CVE-2026-5078","aliases":["GHSA-4vj7-5mj6-jm8m"],"title":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user","summary":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user","severity":"medium","cvss":5.3,"cwe":["CWE-117"],"vendor":"morgan","product":"morgan","ecosystem":"npm","affected":["morgan >= 1.2.0, <= 1.10.1"],"patched":["morgan 1.11.0"],"published":"2026-07-10","updated":"2026-07-10","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4vj7-5mj6-jm8m","references":[{"url":"https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5078"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/advisories/GHSA-4vj7-5mj6-jm8m"}],"tags":["ghsa","npm"],"epss":0.00332,"epssPercentile":0.26546,"ingestedAt":"2026-07-10T15:05:05.664Z","slug":"CVE-2026-5078","body":"## Overview\n\n### Impact\n\nMorgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs.\n\nThe built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`.\n\n### Patches\n\nUsers should upgrade to version 1.11.0.\n\n### Workarounds\n\nUse a custom format string that does not include `:remote-user`.\n\n## Affected packages\n\n- `morgan >= 1.2.0, <= 1.10.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `morgan 1.11.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}